Not every company needs a DPO, and the two laws draw that line in different places.

A data protection officer (DPO) is the organisation's privacy lead with a protected position. The GDPR sets out when one is mandatory and what the DPO does. India's DPDP Act uses the same title but only requires one from a significant data fiduciary.

Spelled out: Data protection officer.

Under GDPR Article 37, a DPO is required for public authorities, and for any controller or processor that, as its main business, tracks people regularly and systematically on a large scale or handles special category or criminal-offence data at scale. The DPO must be involved early, report to the highest management level, and not be dismissed or penalised for doing the job. Tasks include advising, monitoring compliance, advising on DPIAs and acting as contact for the authority. The role can be an employee or a contractor. India's DPDP Act is narrower: only a significant data fiduciary must appoint a DPO, who has to be based in India, answer to the board and act as the contact for grievances. Every other fiduciary only has to publish the contact of someone who can answer questions.

The privacy notice

Under both laws, the contact details of the DPO, or of the person who answers queries, appear here.

An appointment letter

Records reporting line, independence, resources and tasks, which an authority may ask to see.

A filing with the supervisory authority

GDPR Article 37 asks controllers to give the authority the DPO's contact details.

The board agenda

A DPDP DPO for a significant fiduciary answers to the board, so their report belongs there.

Grievance officer

The contact for complaints under India's IT rules and the DPDP Act's grievance process. A DPDP DPO is that contact for a significant fiduciary, but others may name someone else.

CISO

Leads security. A DPO advises on privacy compliance and must be free of conflicts, so combining the roles needs care.

vDPO

An outsourced DPO service. The legal duties still sit with the organisation that appoints the person.

• Test your activities against GDPR Article 37 and record the outcome even if no DPO is needed.
• Publish a contact for privacy questions on your site, as the DPDP Act requires of every fiduciary.
• If you appoint a DPO, set the reporting line and conflict checks in writing.
• Give the DPO a seat in DPIA reviews and breach decisions.

• GuideControllers, processors & DPOsWho decides, who processes, and when a DPO is required.
• GuideGrievance redressal and the contact pointWho people write to, and how complaints are handled.
• GuideSignificant data fiduciariesThe extra duties: DPO, audits and impact assessments.

Sources: Regulation (EU) 2016/679, Articles 35, 37, 38 and 39; Digital Personal Data Protection Act, 2023, sections 2, 8 and 10. Not legal advice.