Blog

Not Every Company Needs a Data Protection Officer

Oct 26, 2026 · vDPO Team

India’s Digital Personal Data Protection (DPDP) Act doesn’t require every company to appoint a Data Protection Officer (DPO).

Section 10(2)(a) requires a Significant Data Fiduciary to appoint a DPO who:

  • Is based in India.
  • Represents the Significant Data Fiduciary under the Act.
  • Is responsible to the Board of Directors or equivalent governing body.
  • Serves as the grievance redressal point of contact.

However, Section 8(9) and Rule 9 require Data Fiduciaries generally to publish business contact information for a DPO, where applicable, or another person able to answer personal data processing queries.

So an organisation may not need a statutory DPO, but it still needs an appropriate privacy contact.

The takeaway: Determine whether your organisation has been notified as a Significant Data Fiduciary, and ensure the required contact arrangements are in place.

This article is general information, not legal advice.

Read next

Governance

India’s DPDP Act Doesn’t Impose a Blanket Ban on Overseas Data Transfers

A company can transfer personal data outside India under the DPDP framework.
Governance

A Data Protection Impact Assessment Isn’t Mandatory for Every Company

Does every company covered by India’s DPDP Act have to conduct a Data Protection Impact Assessment (DPIA)?
Governance

Your Organisation Could Have 100 Privacy Controls and Still Fail a DPDP Compliance Assessment

Documented controls may not be enough. For every privacy control, ask three questions: Is it documented? Is it implemented? Can we prove it?