Check the appointment basis
Under DPDP, the specific DPO appointment duty is linked to government notification as a Significant Data Fiduciary. A sector, staff count or risk label is not that notification.
Review the role, not just the title
For a notified SDF, the Act specifies an India-based individual responsible to the Board or similar governing body. Review timing, the actual notification and the mandate before treating an external arrangement as an appointment.
MeitY: Digital Personal Data Protection Act, 2023 · Gazette: DPDP Act commencement notification, 13 November 2025
Plan the contact and grievance role
Section 8 requires covered Data Fiduciaries to publish a DPO contact if applicable, or the contact of a person able to answer personal-data questions, and to establish an effective grievance mechanism. Rules 9 and 14 address publication and rights/grievance arrangements. These provisions fall in the notified May 2027 phase; a general privacy contact need not hold the title DPO.
MeitY: Digital Personal Data Protection Act, 2023 · MeitY: Digital Personal Data Protection Rules, 2025 · Gazette: DPDP Act commencement notification, 13 November 2025
Choose useful support
Even where a statutory appointment has not been established, a business may need an internal owner, a defined project or recurring advice. Estimate actual work and identify who can implement decisions.
Bring this to the discussion
Collect any notification, existing appointment letter, reporting structure and recurring workload. For overseas activity, examine the separate jurisdiction’s appointment requirements.
Common questions
Does the assessment appoint Prahari as our DPO?
No. A generated report or enquiry creates no appointment. Any named role needs an explicit agreement and appropriate review.
Does a privacy contact have to be called a DPO?
Use a title that accurately reflects the role and mandate. A general contact and a formal DPO are different arrangements.
Discuss the work you need
Agree the service, deliverables, responsibilities and fees before committing to an engagement.
Related reading
References
- MeitY: Digital Personal Data Protection Act, 2023
- Gazette: DPDP Act commencement notification, 13 November 2025
This page explains topics to scope and discuss. It does not establish applicability, certify compliance or confirm a paid engagement.
← Decision guides