Data Protection Officer obligations under the DPDP Act, 2023

Last verified: 17 July 2026

Under the Digital Personal Data Protection Act, 2023, a Data Protection Officer is a mandatory appointment for a Significant Data Fiduciary and only for a Significant Data Fiduciary. Section 10(2)(a) requires that this officer be based in India, be an individual answerable to the Board of Directors, and act as the point of contact for grievance redressal. Every other Data Fiduciary carries a lighter duty under Section 8(9): publish the contact details of a Data Protection Officer or of some person who can answer a Data Principal’s questions about how her data is processed. The distinction between those two duties decides whether your organisation must formally appoint a Data Protection Officer or simply name a contact.

This article sets out what the DPDP Act, 2023 actually requires of a Data Protection Officer, who has to appoint one, and when the obligation begins to bite.

The role became concrete on 14 November 2025, when the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025. Until then the Act had been passed but largely unenforced, and the Data Protection Officer was a position on paper. The Rules put a clock on it.

Two readers tend to arrive at this topic with different questions. One wants the compliance answer: what the statute demands of the office and by when. The other is weighing the role as a career. This piece answers the first question, the legal obligations, and points career readers to the dedicated guides where they belong.

Who must appoint a Data Protection Officer

Only a Significant Data Fiduciary must appoint a Data Protection Officer under the DPDP Act. The obligation flows from Section 10, which applies exclusively to Data Fiduciaries that the Central Government has notified as “significant”. An ordinary Data Fiduciary, meaning any entity that alone or with others decides the purpose and means of processing personal data, does not fall under this requirement.

The Central Government decides who is significant. Section 10(1) lets it notify a Data Fiduciary, or a class of them, as a Significant Data Fiduciary after weighing factors such as the volume and sensitivity of personal data processed, the risk to the rights of Data Principals, the potential effect on the sovereignty and integrity of India, the security of the State, the risk to electoral democracy, and public order. An organisation does not classify itself; it is brought within Section 10 by government notification.

Everyone else still has a related but lighter duty. Section 8(9) requires every Data Fiduciary to publish the business contact information of a Data Protection Officer, if it has one, or of a person able to answer questions raised by a Data Principal about the processing of her personal data. A small Data Fiduciary can satisfy this by naming a responsible contact; it does not need to create the full statutory office that Section 10 describes.

That split matters in practice. A startup processing modest volumes is not obliged to appoint a Data Protection Officer, though it must still name a contact point and run a grievance mechanism. A large platform that the government notifies as significant must appoint the officer with all the attributes Section 10(2)(a) lists. Reading Section 8(9) as if it forced every business to hire a Data Protection Officer is the most common misreading of the Act.

What the DPDP Act requires of a Data Protection Officer

The DPDP Act fixes four attributes of the Data Protection Officer, and it does so in a single provision. Section 10(2)(a) states that a Significant Data Fiduciary shall appoint a Data Protection Officer who shall represent the Significant Data Fiduciary under the Act, be based in India, be an individual responsible to the Board of Directors or a similar governing body, and be the point of contact for the grievance redressal mechanism.

Each attribute carries weight. “Based in India” rules out locating the role offshore, so a multinational cannot run its Indian compliance from a regional privacy hub abroad. “An individual” means the office cannot be handed to a vendor firm or a committee; a named person holds it. “Responsible to the Board of Directors” places the officer high in the reporting line, answerable to the governing body rather than buried under a mid-level manager. “Point of contact for the grievance redressal mechanism” makes the officer the face of the organisation when a Data Principal complains.

What the Act does not do is prescribe qualifications. There is no stipulated degree, no mandatory certification, and no minimum years of experience written into Section 10. The statute defines the office by its location, its reporting line, and its function, and leaves the choice of person to the Significant Data Fiduciary. That silence is deliberate: it lets organisations appoint a senior lawyer, a compliance head, or a technology governance specialist, provided the person can genuinely answer to the Board and manage grievances.

In practice the role tends to be filled by someone who already understands both the law and the organisation’s data flows. Readers weighing the position as a career can look at how the day-to-day responsibilities and pay actually shape up in how to become a Data Protection Officer and the key skills every Data Protection Officer needs. For the compliance question, the point is narrower: the Act sets the office, not the CV.

The Data Protection Officer and grievance redressal

Grievance redressal is the Data Protection Officer’s defining statutory function. Section 10(2)(a) names the officer as the point of contact for it, and two further provisions give that contact real content. Section 8(10) requires every Data Fiduciary to establish an effective mechanism to redress the grievances of Data Principals, and Section 13 gives the Data Principal a matching right to use it.

Section 13 sets the sequence. A Data Principal who has a complaint about how a Data Fiduciary or a Consent Manager has handled her data, or honoured her rights, must first take it to that entity’s grievance mechanism. The Data Fiduciary has to respond within the period the Rules prescribe. Only after exhausting this route can the Data Principal escalate to the Data Protection Board of India. For a Significant Data Fiduciary, the Data Protection Officer sits at the head of that mechanism as the person a complaint reaches first.

This makes the office more than a compliance formality. The Data Protection Officer is the individual who receives grievances, drives a response inside the prescribed timeline, and stands as the organisation’s answerable face if a matter reaches the Board. A mechanism that ignores complaints, or misses the prescribed response window, exposes the Significant Data Fiduciary to escalation and, eventually, to the Board’s penalty powers.

The reporting line reinforces the function. Because Section 10(2)(a) makes the officer responsible to the Board of Directors, grievances do not dead-end at an operational desk. They travel up to a person the governing body can hold to account, which is what turns “an effective mechanism” from a phrase in Section 8(10) into something a Data Principal can actually rely on.

How the DPO fits the wider Significant Data Fiduciary duties

Appointing the Data Protection Officer is one of three obligations that Section 10 places on a Significant Data Fiduciary, and the officer usually ends up coordinating the other two. Section 10(2)(b) requires the appointment of an independent data auditor to carry out a data audit and evaluate the entity’s compliance with the Act. Section 10(2)(c) requires the Significant Data Fiduciary to undertake other measures, including periodic Data Protection Impact Assessment and periodic audit, as prescribed.

The independent data auditor is a separate role from the Data Protection Officer, and the independence is the point. The auditor evaluates whether the Significant Data Fiduciary is actually complying, which is a check on the very compliance the officer manages day to day. In a well-run structure the Data Protection Officer prepares for and responds to that audit rather than marking its own homework.

A Data Protection Impact Assessment is a structured review of a processing activity: what data is collected, why, what could go wrong for the Data Principals, and how those risks are managed. Section 10(2)(c) makes it periodic rather than one-off, so it becomes part of the compliance rhythm the officer oversees. The mechanics of running one are set out in how to conduct a Data Protection Impact Assessment.

None of these three duties is optional for a notified Significant Data Fiduciary, and they interlock. The Data Protection Officer represents the entity and fields grievances, the independent auditor tests compliance, and the periodic impact assessments feed both. Treating the officer’s appointment as a standalone box-tick, without the audit and assessment machinery around it, leaves a Significant Data Fiduciary short of what Section 10 actually requires.

Penalties for non-compliance

The financial exposure for getting data-protection compliance wrong is set out in the Schedule to the DPDP Act, and it is substantial. The Data Protection Board of India can impose a penalty of up to Rs 250 crore where a Data Fiduciary fails to take reasonable security safeguards to prevent a personal data breach. Failure to notify the Board or affected Data Principals of a breach, and breaches of the obligations relating to children’s data, can each attract up to Rs 200 crore. Closest to home for this discussion, breach of the additional obligations of a Significant Data Fiduciary under Section 10 carries a penalty of up to Rs 150 crore, and a residual category covers any other contravention of the Act or the Rules with penalties of up to Rs 50 crore.

That Section 10 entry is the one that speaks directly to the Data Protection Officer. Appointing the officer is one of the additional obligations Section 10 places on a Significant Data Fiduciary, alongside the independent data auditor and the periodic impact assessments. A Significant Data Fiduciary that fails to appoint a compliant officer, or lets the role lapse, is in breach of a Section 10 obligation, and that breach sits within the up-to-Rs-150-crore band the Schedule sets. The exposure is specific, not merely indirect.

The Board decides these penalties after an inquiry, and Section 33 directs it to weigh factors such as the nature and gravity of the breach, its duration, whether it was repetitive, and any gain the breaching party made. The amounts named in the Schedule are ceilings, not automatic charges, so a genuine compliance function, with a real officer answerable to the Board, is part of what the Data Protection Board of India would weigh before fixing a figure.

For a Significant Data Fiduciary, that reframes the appointment. The Data Protection Officer is not a cost centre added to satisfy Section 10; the office is the organisation’s first line of defence against the very penalties the Schedule sets out.

When the DPO obligation takes effect

The Data Protection Officer obligation is not yet in force, and the countdown started on 14 November 2025. That is the date the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, which set out how the Act is to be implemented and on what timeline. The Act itself was passed in 2023, but its substantive obligations were held back until the Rules arrived.

Implementation is phased rather than immediate. The provisions establishing the Data Protection Board of India were brought into operation first, so that the enforcement body could be set up. The obligations that sit in Section 10, including the appointment of a Data Protection Officer, an independent data auditor, and periodic Data Protection Impact Assessments, are set to come into force roughly eighteen months after the Rules were notified, which points to around the middle of May 2027.

That runway is the window in which Significant Data Fiduciaries are expected to build the function. Identifying a suitable individual based in India, defining a reporting line to the Board, standing up a grievance mechanism, and arranging for independent audit all take time, and the phased dates exist so that entities can prepare before the duties are enforceable. Organisations likely to be notified as significant are not well served by treating mid-2027 as a distant deadline. A practical operational breakdown of the phased Rules and what businesses should do in the interim is set out in this DPDP Rules 2025 operational compliance guide.

The dates should be read as indicative of a phased rollout rather than a single switch. What is settled is the direction: the Data Protection Officer moves from a paper requirement in the 2023 Act to an enforceable obligation once the Section 10 timeline matures, and the Rules of 14 November 2025 are what set that clock running.

Frequently asked questions

Is a Data Protection Officer mandatory for every company under the DPDP Act?

No. A Data Protection Officer is mandatory only for a Significant Data Fiduciary, meaning a Data Fiduciary that the Central Government has notified as significant under Section 10. Every other Data Fiduciary has the lighter duty in Section 8(9) of publishing the contact details of a Data Protection Officer or of a person who can answer a Data Principal’s questions about processing.

Does the DPDP Act require the Data Protection Officer to be based in India?

Yes. Section 10(2)(a) expressly requires the Data Protection Officer of a Significant Data Fiduciary to be based in India. A multinational cannot satisfy the requirement by running the function from an office abroad.

Can an existing employee or an external consultant be the Data Protection Officer?

The Act fixes what the office must be, not where the person comes from. Section 10(2)(a) requires the officer to be an individual, based in India, responsible to the Board of Directors, and the point of contact for grievance redressal. An existing senior employee can hold the role provided these conditions are met; the requirement that the officer be an individual answerable to the Board makes handing the whole office to an outside firm difficult.

What qualifications does the DPDP Act require for a Data Protection Officer?

The Act prescribes no specific degree, certification, or minimum experience. Section 10 defines the office by its location in India, its reporting line to the Board, and its grievance function, and leaves the choice of person to the Significant Data Fiduciary.

When do the Data Protection Officer obligations under the DPDP Act come into force?

The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 and phase the Act in over roughly eighteen months. The Section 10 obligations, including appointing a Data Protection Officer, are set to become enforceable around the middle of May 2027.

What penalties apply if a Significant Data Fiduciary fails to comply?

Penalties are set in the Schedule to the Act and imposed by the Data Protection Board of India after an inquiry. Breach of the additional obligations of a Significant Data Fiduciary under Section 10, which include appointing the Data Protection Officer, can attract up to Rs 150 crore. The Schedule also sets up to Rs 250 crore for failing to take reasonable security safeguards, up to Rs 200 crore for failing to notify a breach or for breaching children’s-data obligations, and up to Rs 50 crore for other contraventions.

References

• The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Section 10, Section 8 and Section 13.
• The Digital Personal Data Protection Act, 2023, full text on India Code.
• Ministry of Electronics and Information Technology, notification of the Digital Personal Data Protection Rules, 2025, Press Information Bureau (14 November 2025).

This article is for informational purposes only and does not constitute legal advice. For specific legal guidance, consult a qualified legal professional.