How to Set Up Governance, Contact Point and Records (Rule 9)
Governance is who owns what, what you publish, what you keep as proof, and what happens if the Board contacts you. This DPDPA 2023 course page explains how to set up governance in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Publish a contact (Rule 9) (how to set up governance)
Display, prominently on your website and app, the business contact of a Data Protection Officer or another person who can answer questions about processing. Repeat the contact in every reply to a rights request. A Significant Data Fiduciary must appoint a Data Protection Officer based in India.
Privacy contact: [Name], [Role] Email: privacy@yourcompany.com Phone: [number] Address: [registered office] Write to us about your personal data, consent, requests or complaints.
Who does what
| Role | Responsibility |
|---|---|
| Owner (founder or director) | Approves policies, signs off risks, receives breach alerts |
| Privacy owner | Runs inventory, notice, requests, breach plan, training, evidence folder |
| IT lead | Security controls, logs, backups, access reviews |
| Marketing | Consent, unsubscribe, cookie banner |
| HR | Employee data, retention |
| All staff | Report suspected breaches and requests immediately |
Annual calendar (how to set up governance)
| When | Task |
|---|---|
| Quarterly | Access review, vendor changes, inventory update, request statistics |
| Every 6 months | Backup restore test |
| Yearly | Breach drill, staff training, policy review, notice review, SDF DPIA and audit if applicable |
| After any change | Update inventory and notice when you add a new tool, purpose or vendor |
If the Board contacts you
The Board works as a digital office. Inquiries must finish within 6 months (extendable by up to 3 months). Under Section 32 you may offer a voluntary undertaking; if accepted, proceedings on that matter can end. Orders can be appealed to the Appellate Tribunal digitally (Rule 22; the Act gives 60 days).
- Acknowledge on time and name one point of contact.
- Collect evidence from the evidence folder.
- Fix gaps immediately and record the date.
- Take legal advice before replying to formal notices.
- Consider a voluntary undertaking if you have a real gap.
- Check appeal deadlines on any order.
The Central Government can require information for specified purposes and may bar you from telling the affected person. Do not ignore such a notice; get legal advice the same day.
Training in 30 minutes (how to set up governance)
- What counts as personal data
- Do not share it casually or by personal email or chat
- How to spot and report a breach
- What to do if a customer asks to see, correct or erase data
Related guides
Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.