Back to Module
4 of 8|Significant Data Fiduciary (SDF)
reading 20 min•SDF Framework
DPO Requirements
The mandatory Data Protection Officer based in India.
🎯 Learning Objectives
- ▸ Understand the role of a DPO
- ▸ Learn the qualifications and independence required
The Role of the DPO
Under Section 10(2)(a), an SDF must appoint a Data Protection Officer. This is not just an IT role; it is a senior governance role.
- • Represent the SDF under the DPDPA.
- • Act as the point of contact for the Data Protection Board.
- • Monitor compliance and advise the board of directors.
- • Ensure that Data Protection Impact Assessments (DPIAs) are conducted.
The DPO must be independent. If the DPO is the CEO or the Head of IT who has a conflict of interest, the appointment will not be compliant.
📖 Glossary
- DPO
- Data Protection Officer, a senior executive responsible for data protection compliance within an SDF.
🔑 Key Takeaways
- The DPO must be based in India.
- The DPO must report to the Board of Directors, not the CEO.
- The DPO is the point of contact for the Data Protection Board.
📚 Further Reading
- DPDPA Section 10(2)(a) — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...