Do You Need a DPO? Contact Persons and Grievance Officers

"Do we have to hire a DPO?" is one of the first questions founders ask about the Digital Personal Data Protection Act, 2023 (the DPDP Act). For almost every business the answer is no. What the Act asks of everyone is smaller: a named person who can answer questions about personal data, and a complaints process that answers within 90 days. Both duties apply from 13 May 2027.

Only Significant Data Fiduciaries need a DPO

A data fiduciary is any business that decides why and how personal data is processed. The Central Government may designate some fiduciaries as Significant Data Fiduciaries (SDFs) under s.10(1), weighing factors such as the volume and sensitivity of the data and the risk to people's rights. Only SDFs must appoint a Data Protection Officer. Section 10(2)(a) says the DPO must:

• represent the SDF under the Act;
• be based in India;
• be "an individual responsible to the Board of Directors or similar governing body"; and
• be the point of contact for grievance redressal.

Section 10 commences on 13 May 2027, so no designation can be made before then. Breaching SDF duties can attract a penalty of up to ₹150 crore.

A smaller business may appoint one voluntarily, but the title should come with real time and authority.

Every business needs a contact person

Section 8(9) requires every fiduciary to publish the business contact information of its DPO, "if applicable", or of "a person who is able to answer" a data principal's (an individual's) questions about the processing of her personal data. Rule 9 of the DPDP Rules, 2025 adds two details: the contact must be published prominently on the website or app, and mentioned in every response to a request to exercise rights.

The same contact recurs. Section 6(3) requires consent requests to give the contact details of the DPO or another authorised person, and Rule 7 requires breach notices to name someone who can answer questions; Trayambic's whitepaper on breach notification covers those notices.

In our view a monitored role address, such as a privacy mailbox, satisfies s.8(9) if a named, trained person stands behind it and can actually answer. An address that bounces does not.

Grievances: 90 days, then the Board

Section 13(1) gives every data principal the right to "readily available means of grievance redressal" from the fiduciary, and from consent managers. Section 13(2) requires a response within the prescribed period, and Rule 14(3) sets it: the mechanism must be published prominently, and grievances answered within a reasonable period not exceeding 90 days, backed by suitable technical and organisational measures.

Section 13(3) requires the data principal to exhaust this process before approaching the Data Protection Board of India. A process that works keeps complaints in-house. Ninety days is a ceiling, not a target.

One desk for several laws

Many businesses already have a grievance officer under another law.

One person or desk can usually cover all of these. Run a single intake, tag each complaint by the laws it engages, and apply the shortest clock. A privacy complaint to an online marketplace is both a consumer grievance and a DPDP grievance, so in our view it follows the one-month consumer clock. Keep each regime's own conditions: residence in India for a Resident Grievance Officer, General Manager rank for an RBI Principal Nodal Officer.

Steps for a small business

1. 1.Name the person, someone who knows your systems, and a deputy.
2. 2.Publish the contact in your website or app footer and privacy notice, and on consent screens.
3. 3.Add it to every rights reply through your email templates, as Rule 9 requires.
4. 4.Run one intake, a form and a mailbox, that issues a reference number and timestamp and tags each complaint by regime.
5. 5.Set internal targets: acknowledge within 48 hours, resolve within 30 days, escalate by day 60, never exceed 90, and use any shorter legal clock.
6. 6.Keep a log of each grievance, reply and date; it is your evidence if the Board asks.
7. 7.Train the person to tell a rights request from a complaint, and to escalate anything that looks like a breach.

The short answer

Unless the government designates you an SDF, you do not need a DPO. You do need a real person whose contact is published, a complaints process that answers within 90 days and, if other laws already gave you a grievance officer, a single desk on the shortest clock. Trayambic's health-tech, e-commerce and social media studies apply this by sector.

Key takeaways

• Only a Significant Data Fiduciary must appoint a DPO, who must be based in India and answer to the board (s.10(2)(a)); s.10 commences on 13 May 2027.
• Every data fiduciary must publish a contact person able to answer data questions, prominently and in every rights response (s.8(9); Rule 9).
• Grievances must be answered within a reasonable period of no more than 90 days (Rule 14), and people must use this route before going to the Board (s.13(3)).
• Grievance officers under the IT Rules, e-commerce rules, RBI scheme and insurance rules run shorter clocks; one desk can serve all of them on the shortest clock.