Under India’s DPDP Act, 2023, a Data Protection Officer (DPO) is a statutory requirement for every entity designated a Significant Data Fiduciary (SDF). Even where the role is not strictly mandatory, many organisations appoint or outsource a DPO-style function to coordinate compliance. This page explains the legal position and how KSK’s data-privacy team supports the DPO function.
When is a DPO mandatory?
Section 10(2)(a) requires an SDF to appoint a DPO who is based in India and responsible to its Board of Directors or equivalent governing body. Ordinary data fiduciaries are not obliged to appoint a DPO, but must still publish the contact details of a person able to answer data principals’ questions and operate a grievance-redressal mechanism (Sections 8(9)–(10)). For the full picture, see our article on the role and duties of a DPO and on Significant Data Fiduciaries.
Are you a Significant Data Fiduciary?
Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF.
What the DPO does
- Acts as the point of contact for the grievance-redressal mechanism and for the Data Protection Board.
- Reports to the board on data-protection risk and compliance.
- Oversees notice and consent practices, data-principal rights requests, retention and erasure, and vendor/processor governance.
- Coordinates breach response and the periodic DPIAs and independent audits that SDFs must conduct.
The Act does not currently prescribe specific qualifications for the role, which gives organisations flexibility in how they resource it.
How KSK supports the DPO function
We help clients stand up and run the DPO function in a way that fits their structure — advising an in-house DPO, supporting the role on an ongoing basis, or providing an external DPO-style function for organisations that prefer to draw on specialist counsel. Typical support includes building the compliance framework the DPO operates, handling data-principal and grievance escalations, advising the board, and managing breach and regulator interactions. We also help businesses assess whether they are likely to be designated an SDF and therefore brought within the mandatory-DPO requirement.
Related reading
See our analysis of the grievance officer’s role and our DPDPA guide. To gauge whether the DPO obligation may apply to you, try the free Compliance Scorecard.
Talk to KSK about your DPDP readiness
Our data-privacy team advises Indian and global businesses on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. To understand where you stand, try our free DPDPA Compliance Scorecard or speak to our team.
This page is general information about Indian data-protection law and is not legal advice or a solicitation. Provisions of the DPDP Act and Rules are subject to phased commencement and further notification.
Explore KSK Data Privacy Hub
Free compliance tools and expert guidance covering 75+ jurisdictions.