Under the DPDP Act, only Significant Data Fiduciaries must appoint a Data Protection Officer, who must be based in India and answerable to the board of directors. Every other business must publish the business contact details of a DPO (if it has one) or of a person who can answer questions about its processing of personal data, prominently on its website or app and in every response to a data request (Rule 9).
- Mandatory for
- Significant Data Fiduciaries
- Location
- Based in India
- Everyone else
- Publish a contact person (Rule 9)
What a DPO does
- Acts as the point of contact for Data Principals' grievances.
- Represents the business on DPDP matters and reports to its board.
- Oversees notices, consent, retention, breach response and rights requests.
- Coordinates the annual DPIA and audit (for SDFs).
Who can be the contact person
For non-SDFs, any responsible employee or an outsourced DPO service can be the published contact. Use a role email (for example privacy@yourdomain) rather than a personal one so it survives staff changes.
Frequently asked questions
Can a DPO be outsourced?
For businesses that are not SDFs, yes: the published contact can be an external service. For SDFs, the DPO must be based in India and responsible to the board, so outsourcing needs careful structuring.
Where must the DPO contact be published?
Prominently on the website or app, and in every response to a Data Principal who exercises their rights (Rule 9).
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.