Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsRole
A Data Protection Officer (DPO) is the India-based individual a Significant Data Fiduciary must appoint to represent it and be the point of contact for grievances.
TL;DR
A Data Protection Officer, or DPO (Section 10(2)(a)), is the India-based individual a Significant Data Fiduciary must appoint to represent it and act as the contact point for grievances. The DPO is answerable to the fiduciary's board and is the human face of its compliance.
"Data Protection Officer" means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10.
The DPO is a mandatory role only for Significant Data Fiduciaries. Section 10(2)(a) requires the DPO to be based in India and answerable to the fiduciary's board.
The DPO represents the fiduciary under the Act and is the contact point for the grievance redressal mechanism, making them the human face of compliance.
A notified SDF appoints a DPO in India whose contact details are published so Data Principals can raise questions and complaints.
Does every organisation need a DPO?
No. Only Significant Data Fiduciaries must appoint one under Section 10(2)(a).
Must the DPO be in India?
Yes. The DPO must be based in India and responsible to the fiduciary's governing body.
Consultant-led and partner-backed.