Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 23 September 2026. Methodology

Role guide

Compliance and data protection officers

Compliance usually runs the company plan: tracking what applies, who owns what, and whether the evidence would satisfy a reviewer. Ownership of individual controls stays with the delivering functions.

What does the DPDP framework mean for Compliance and data protection officers?

Compliance usually owns the plan rather than the controls: what applies, who owns each duty, and whether the evidence would satisfy a reviewer. The published contact point, the rights and grievance machinery and the reporting path to the Board are the pieces most often missing entirely. Individual controls stay with the functions that deliver them.

How to read this page. The obligations belong to your organisation, not to a role or a sector. Everything here is practical emphasis: which official duties this audience usually leads or feeds into, with links to the official text. Finishing one function's work never makes the company compliant by itself.

Work your function usually leads

  • Published contact for data questionsRule 9, official text →

    Publishing the contact who can answer processing questions, and keeping it in every rights response, is usually a compliance owned control.

  • Rights and grievance machineryRule 14, official text →

    The published request channels and the grievance response system are the backbone of individual facing compliance.

  • Significant Data Fiduciary dutiesRule 13, official text →

    If notified as significant, the annual impact assessment, audit and Board reporting cycle is run from compliance.

Work your function usually feeds into

  • Breach reporting to the BoardRule 7, official text →

    The staged Board intimation is usually filed by compliance on facts from security.

  • Retention schedule governanceRule 8, official text →

    Compliance keeps the retention schedule honest; engineering executes it.

Tools for this role

Tool

Compliance Plan

Generate 1 company level action plan and see the work for your role first.

Open

Tool

Privacy Notice Checker

Check whether your notice covers the elements the DPDP sources require.

Open

Tool

Vendor and Processor Checklist

Identify DPDP relevant actions for your vendors and Data Processors.

Open

Guides written for this audience