Do you need a Data Protection Officer under the DPDP Act?

The Digital Personal Data Protection Act sets extra duties for a category called Significant Data Fiduciary. The government decides who falls into it, based on factors such as the volume and sensitivity of the data handled. Factors that the government may weigh include how much data you handle, how sensitive it is, the risk to the people concerned and the effect on public order.

Those duties include appointing a Data Protection Officer who is based in India and reports to the board or a similar body. They also cover independent audits and impact assessments.

Whether your business is notified is a legal fact, not a guess. Ask your lawyer to confirm your status and to watch for any notification. If your lawyer says you are not notified today, ask them to flag the thresholds that would change that, so growth does not catch you unprepared.

Without the title, the work remains. Someone must answer when a customer asks what you hold on them. Someone must receive a complaint and someone must keep the incident log. A customer may email asking for a copy of what you hold, a former employee may ask for a correction, and a parent may complain about a form entry.

The Act also expects a published contact for questions about the data you process. A shared mailbox with a named owner is enough to start. A mailbox nobody reads is worse than none.

Name a person and a backup. Put both in the privacy notice and the internal handbook. Add the contact to the website footer, the privacy notice and the email signature of whoever runs the mailbox, so enquiries land with the right desk.

Spread the work by role. Do not load one person. The founder signs off on the policy. Operations or IT runs the system side. HR handles employee data. Marketing owns the forms. A practical split gives HR the employee files, sales the CRM and lead forms, finance the invoices and KYC papers, and IT the access lists and deletion jobs.

Give one person the three registers: data principal requests, incidents and processors. This is often the operations head or an office manager with a calm temperament. Keep these three registers in one shared sheet with a monthly reminder, since scattered notes in personal inboxes are the first thing lost when someone leaves.

Write the split on one page. A new joiner should read it in five minutes.

If you handle health, children’s or financial data, or process data at scale, ask a lawyer whether you could be notified. Plan for that case early, even if you are not in it today. Health clinics, lending firms, schools and apps used by children handle data that regulators watch closely, so those firms should ask the question earlier than a trading company would.

A part-time adviser can act as the contact while you grow. They review the registers quarterly and join incident calls. They do not replace an owner inside the firm.

Choose someone who can read your systems as well as your contracts. Policies that ignore how the software works fail on the first request. Hand the adviser your data map, your vendor list and a sample incident record in the first week, so their advice rests on your actual systems.

Write three lines: who answers requests, who keeps the incident log, who maintains the processor register. Add the backup for each.

Then test the chain. Send a mock request from a personal email and time how long the answer takes. Fix the slowest step. Whoever is named should also see the mock result, because a request that sits unanswered for two weeks tells you more than any policy document will.

Share the one-page role sheet with your lawyer for a check against your status.