Definition
Section 10(2)(a) of the Digital Personal Data Protection Act, 2023 requires a Significant Data Fiduciary to appoint a Data Protection Officer who represents the SDF, is based in India, and is responsible to the Board of Directors or similar governing body. The DPO is the point of contact for grievance redressal under the Act. SDF status itself arrives only by Central Government notification under Section 10(1). Until that notice, you are not forced to hire a statutory DPO. You still need a person who can answer processing questions — Rule 9 asks you to publish business contact information of the DPO if applicable, or of another person who can answer.
How this matters in practice
Do not staff a DPO theatre while notices, grounds and the dual clock are missing. Name an operations owner for consent, erasure and Rule 14 tickets. If a Section 10 notice arrives, the DPO must be in India and answerable to the board — that is not a vendor logo. Software is not the Section 10(2)(b) independent auditor. Rule 13 DPIA and audit start only after SDF notification.
Frequently asked questions
Do we need a DPO because we hold Aadhaar or payroll?
No. Those files are personal data under Section 2(t). A DPO is an SDF obligation after a Section 10 notice. You still owe notices, a lawful ground — payroll can sit under Section 7(i) — security, dual-clock reporting and processor contracts.
Can our SaaS vendor be our DPO?
Not as a substitute for Section 10(2). The DPO represents the SDF, is based in India, and is responsible to your board. A vendor is a Data Processor unless it is a registered Consent Manager. Processor copies remain personal data.
If we are not an SDF, who publishes a contact?
Rule 9: publish the DPO's business contact if you have one, or a person able to answer questions about processing, and repeat it when you reply to a rights communication. That person is not automatically a DPO and does not trigger Rule 13.
Sort DPO versus operations owner
Book 30 minutes to see whether you need a Section 10(2) DPO track or an internal owner for notices and Rule 14 before 13 May 2027.
Book a demo
Free Gap Analysis
Disclaimer: Privigo is not a law firm. This page provides operational compliance guidance only. For institution-specific obligations, work with qualified Indian legal counsel.