When this work helps
For businesses needing a published privacy contact and support with enquiries or grievances, including those without a formal DPO appointment requirement.
Scope and practical outputs
Agree the named privacy contact, monthly coordination capacity, reporting and escalation to the organisation’s decision-makers. Product setup and implementation are outside this retainer.
- A named contact arrangement and business contact details prepared for publication, subject to an agreed mandate.
- Advice on intake, identity-check and escalation responsibilities.
- A summary of coordinated matters, open decisions and actions for client owners.
- Agreed monthly capacity, reporting cadence and escalation to the client decision-maker.
What your team contributes
Provide a response owner and contacts in systems, HR, customer support and relevant providers. Authorise disclosure or deletion decisions and identify legal retention constraints.
An example to discuss
A former customer asks what information is held. The owner identifies relevant systems, checks who may respond and records the search outcome before sending an approved reply.
Agree the boundaries
The company retains responsibility for its processing and business decisions. A managed contact service is not automatically a statutory DPO appointment. Agree case volumes, language coverage, response commitments and any backlog separately. DPDP contact and grievance provisions enter the notified eighteen-month commencement phase in May 2027; existing sector-specific duties need a separate review.
Common questions
Does every business need a formal DPO?
The DPDP Act links formal DPO appointment to notified Significant Data Fiduciaries. Other covered businesses must plan for publication of a person able to answer data-processing questions and an effective grievance mechanism under the relevant commencement phase.
Can Prahari act as our privacy contact?
We offer that role through an agreed named contact and written authority. The arrangement specifies which questions we handle, the access needed and when your team must make or approve a decision.
Does the retainer include a request-handling product?
No. The software is coming soon. Professional implementation services can be scoped separately; they are not automatically included in the retainer.
Does a deletion request mean delete everything immediately?
No. The responsible owner must consider the request, applicable requirements and any valid retention constraints before acting.
Discuss the work you need
Agree the service, deliverables, responsibilities and fees before committing to an engagement.
Related reading
References
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: Digital Personal Data Protection Rules, 2025
- Gazette: DPDP Act commencement notification, 13 November 2025
This page explains topics to scope and discuss. It does not establish applicability, certify compliance or confirm a paid engagement.
← Services