Do You Need a DPO Under India's DPDP Act?

Not every business needs a Data Protection Officer under India's DPDP Act. Only a Significant Data Fiduciary has to appoint one, and only the Central Government can give a company that label.

Still, "the law doesn't require it yet" is a risky place to stop. Companies that handle large volumes of sensitive data can be notified with little warning, and clients, banks and investors increasingly ask who owns privacy inside your organisation.

This guide explains who must appoint a DPO, what the role covers, where it should sit, and how to get ready without waiting for a notification.

Who must appoint a DPO

Section 10 of the DPDP Act 2023 puts the DPO duty on a Significant Data Fiduciary (SDF) alone. Every other Data Fiduciary is outside this obligation, though all of them still owe duties on consent, notice, breach handling and grievance redressal.

The Central Government decides who is an SDF. It looks at factors such as:

• The volume and sensitivity of the personal data you handle

• Whether you process children's data

• Use of AI, profiling or automated decisions

• The risk to individuals' rights

• Your wider significance to the system

This obligation belongs to the group of Rules that apply eighteen months after the DPDP Rules were published, so the practical start date is around May 2027. Check the official MeitY notifications before you plan around that date.

Why waiting is the wrong question

A fast-growing company in finance, health or AI-driven services could become an SDF candidate without any advance notice. If you wait for that notification, you build the function under time pressure.

There is a commercial side too. Enterprise customers, banks and investors increasingly want to see a named person accountable for privacy. Appointing a privacy lead or DPO-equivalent now is a low-cost way to answer that question.

What a DPO does, and where the role sits

A DPO advises leadership on new products and data uses, owns risk assessments, acts as the contact for the Data Protection Board of India, oversees grievance redressal, coordinates breach response and runs or commissions audits.

The role does not cover day-to-day IT security, signing off decisions as a formality, carrying revenue targets for products under scrutiny, or being the only defence in a dispute.

The DPO should not report to the teams they oversee. The cleanest options are the CEO, the General Counsel or the Chief Risk Officer, with the right to escalate directly to the board. A privacy steering committee that meets at least quarterly keeps the work cross-functional.

Six steps to get ready

1. Map your personal data processing.

2. Name one accountable owner.

3. Standardise consent and notice flows.

4. Add DPDP-aligned terms to vendor contracts.

5. Build a breach response plan and rehearse it.

6. Report to the board on a fixed schedule.

Common questions

Does every company need a DPO? No. Only a notified Significant Data Fiduciary, with the duty expected to apply around May 2027.

Can one person hold the role alongside another job? In a smaller organisation, yes, as long as conflicts of interest are managed. The DPO should not be marking their own work.

Can a consultant be our DPO? Consultants can build and support the programme, but accountability stays with your organisation.

Is a Consent Manager the same thing? No. A Consent Manager is a separate registered entity. A DPO is an internal governance role.

The takeaway

You probably don't need a statutory DPO today, but you do need someone who owns privacy. Name that person, map your data, tidy your consent and notice flows, and rehearse your breach plan. If a notification ever arrives, you will already have the function in place.

This article is general information, not legal advice. Confirm dates and thresholds against the official MeitY sources.