Contact information of person to answer questions about processing
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 50 croreAct, Schedule, item 7
- Binds
- Every Data Fiduciary
In plain English
Every Data Fiduciary must publish prominently on its website or app the business contact information of its Data Protection Officer, if it has to have one, or otherwise of a person who can answer questions about how it processes personal data. The same contact must appear in every response to a rights request. Only Significant Data Fiduciaries must appoint a DPO under s. 10 of the Act; everyone else still needs a named, published contact.
What you must do
Publish a business contact (a role mailbox is fine) for data processing questions on your website and app, and include it in every rights response.
If you are a Significant Data Fiduciary, that contact is your Data Protection Officer, who must be based in India.
Gazette text · Rule 9Every Data Fiduciary shall prominently publish on its website or app, and mention in every response to a communication for the exercise of the rights of a Data Principal under the Act, the business contact information of the Data Protection Officer, if applicable, or a person who is able to answer on behalf of the Data Fiduciary the questions of the Data Principal about the processing of her personal data.
- Every Data Fiduciary shall prominently publish on its website or app, and mention in every response to a communication for the exercise of the rights of a Data Principal under the Act, the business contact information of the Data Protection Officer, if applicable, or a person who is able to answer on behalf of the Data Fiduciary the questions of the Data Principal about the processing of her personal data.
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log