The statutory basis for appointing a DPO
Section 10(2)(a) of the DPDPA requires the Significant Data Fiduciary to appoint a Data Protection Officer based in India. The DPO represents the Significant Data Fiduciary before the Data Protection Board (Section 10(2)(a)).
Rule 11 of the DPDP Rules, 2025 requires the Significant Data Fiduciary to publish the business contact details of the Data Protection Officer. Rule 9 separately requires every Data Fiduciary to publish the contact details of the person who answers questions about processing.
The Act does not require the DPO to be an employee of the organisation. It requires appointment and India residency. A fractional or outsourced DPO meets both conditions when the person is based in India and is formally appointed by the Significant Data Fiduciary.
What the DPO does day to day
The Act names one explicit function: representing the Significant Data Fiduciary before the Data Protection Board. The remaining functions flow from Section 10 and the Rules:
- Board communication: the DPO is the point of contact for the Data Protection Board on complaints, inquiries, breach notifications and audit reports.
- Grievance oversight: Data Principals may address complaints to the DPO. The DPO ensures grievances are resolved within the timelines in Rule 14.
- DPIA coordination: the DPO oversees the data protection impact assessment required by Rule 13 every twelve months.
- Audit liaison: the DPO coordinates with the independent data auditor (Section 10(2)(b)) and ensures the audit report reaches the Board.
- Training: the DPO ensures staff who handle personal data understand the duties under the Act.
- Internal advisory: the DPO advises on consent design, notice wording, vendor contracts, retention schedules and cross-border transfers.
How a fractional model works
A fractional DPO is a qualified professional engaged on a retainer or part-time basis. The person is formally appointed by the organisation, based in India, and available for Board communication and day-to-day guidance.
- A formal appointment letter or board resolution names the fractional DPO and defines the scope.
- The DPO’s contact details are published as required by Rule 11.
- The fractional DPO attends periodic reviews, coordinates the annual DPIA and audit, and is reachable for urgent matters such as breach notification.
- The model is suited to organisations that do not need a full-time DPO headcount but must meet every statutory obligation.
When a fractional DPO is appropriate and when it is not
A fractional DPO works well for organisations with a defined data footprint, a manageable volume of Data Principal grievances, and internal teams that can execute day-to-day compliance tasks under guidance.
A full-time DPO may be necessary where the volume of personal data is very large, the grievance volume is high, or the organisation operates in multiple regulated sectors where the DPO must coordinate with other regulators simultaneously.
In either case, the legal obligations are the same. The choice is about capacity, not about reducing the scope of the role.
The penalty for not appointing a DPO
The Schedule to the Act prescribes a penalty of up to ₹150 crore for breach of the additional obligations of a Significant Data Fiduciary under Section 10. Failing to appoint a DPO, or appointing one who is not based in India, falls under this ceiling.
The Board decides the actual penalty after an inquiry, having regard to the factors in Section 33(2).
How AMLEGALS delivers the fractional DPO service
AMLEGALS is an Indian law firm. Its data privacy practice is led by Anandaday Misshra, Founder & Managing Partner. The team includes Rohit Lalwani, Associate Partner, who works on DPDPA compliance.
The fractional DPO engagement includes a formal appointment, published contact details, Board-readiness protocols, periodic DPIA and audit coordination, grievance-response oversight, and advisory on new processing activities.