Data Protection Officer

DPDP Act 2023 — Section 10(2)(a)

A Data Protection Officer (DPO) is a senior officer appointed by a Significant Data Fiduciary under Section 10(2)(a) of the DPDP Act 2023 to act as the point of contact for the Data Protection Board of India and for data principals (individuals). The DPO must be based in India and represents the Data Fiduciary in all interactions with the regulatory authority. The DPO is responsible for overseeing compliance, handling data principal requests, managing breach notifications, and liaising with the Data Protection Board during investigations and adjudication proceedings.

The Data Protection Officer required under Section 10(2)(a) of the DPDP Act 2023 is the human face of an institution's data compliance — the named contact for both the Data Protection Board of India and individual data principals. In practice the DPO must be genuinely based in India and senior enough to drive compliance across business lines, not a nominal appointment. Day to day, the role covers fielding data principal requests, supervising breach notification, maintaining records that show compliance, and representing the institution if the Board opens an inquiry or adjudication. For a regulated lender, the DPO becomes the single point through which a borrower's data grievance or a regulator's query is routed and answered on record. Getting the appointment wrong — leaving the role vacant, placing it offshore, or staffing it without authority — weakens the institution's ability to respond and signals non-compliance to the regulator. Well-advised Significant Data Fiduciaries document the DPO's mandate and reporting line clearly.