DPO Training: DPDP Governance & Expert Course

The Data Protection Officer Under DPDP Act & Rules

Statutory Foundation

Section 10(2) of the DPDP Act requires every Significant Data Fiduciary (SDF) to appoint a Data Protection Officer (DPO) based in India. The DPO represents the SDF to the Data Protection Board and is the single point of contact for Data Principals and the Board.

Rule 12 further specifies that the DPO must be a senior officer (or equivalent) who reports to the Board of Directors or the highest governance body of the SDF. This ensures the DPO has the organisational stature and access necessary for effective oversight.

Key Responsibilities

1. Board-Level Governance

• Report directly to the board of directors or equivalent governing body
• Present regular data protection assessments and risk reports
• Advise on privacy impact of business initiatives
• Ensure that data protection is integrated into corporate strategy

2. Regulatory Interface

• Act as the primary point of contact with the Data Protection Board
• Coordinate responses to Board inquiries, audits, and orders
• Manage breach notifications (both CERT-In and Board timelines)
• Oversee compliance with Board directions and guidelines

3. Internal Oversight

• Monitor compliance with the DPDP Act across the organisation
• Conduct or commission Data Protection Impact Assessments (DPIAs)
• Oversee grievance redressal for Data Principals
• Ensure data processing agreements with processors are adequate
• Review and approve data transfers, especially cross-border

4. Independence

The DPO must maintain independence in their assessment role. While they advise the business, their compliance assessments should not be overridden by commercial considerations. Document disagreements when business decisions deviate from DPO recommendations.

Practical Governance Structure

SDF Determination

An entity becomes a Significant Data Fiduciary when designated by the Central Government based on factors including:

• Volume and sensitivity of personal data processed
• Risk to Data Principals' rights
• Potential impact on sovereignty and integrity of India
• Risk to electoral democracy
• Security of the State

Once designated, the additional obligations (DPO appointment, DPIA, annual audit) are mandatory.

Key takeaway: The DPO is not a checkbox role — it is a senior, independent governance function with direct board reporting, regulatory interface responsibilities, and oversight of the entire data protection programme.