Who owns accountability for personal data in practice?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY)
Short answer: Named owners, accepted by them, for each duty
The organisation is accountable under the Act, and management decides who answers for each duty inside it. In practice that means a named owner for each duty and each major system, written down and accepted by that person. An owner whose name was typed in by someone else, without their agreement, is not really an owner.
Why it matters
Section 8(1) puts responsibility on the Data Fiduciary. Section 8(9) asks for a published contact person.
- Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
- Section 8(9)–(10) · Rules 9, 14: Publish the business contact of a DPO or another person who can answer questions about personal data. Run a working grievance process and reply within a reasonable period, not more than 90 days.
- Section 10 · Rule 13: The government may notify organisations as Significant Data Fiduciaries based on the volume and sensitivity of data and the risk involved. They need a DPO based in India, an independent data auditor, and a yearly impact assessment and audit. None had been notified when this page was last reviewed.
A worked example
A ministry lists eight duties and proposes an owner for each. Six accept by email; two say the duty sits with another division. The register is corrected before an incident tests it.
Steps
- List duties and major systems.
- Propose an owner for each.
- Ask each owner to accept in writing.
- Publish the overall contact person.
- Review owners when people move.
Evidence to keep
- Owner register with acceptances
- Published contact
- Review dates
Common mistakes
- Owners assigned without telling them
- One person owning everything
- Owners who left the organisation
Who does what
- Company secretary: Board-approved roles avoid arguments about who owns what during an incident.
- Chief compliance officer: Name an owner for every duty in one register approved by management.
What a good answer from management sounds like
“Every duty and major system has an owner who accepted it in writing, and we review the list when people move.” Effort and time: Light · 2 to 4 weeks.