Business Contact Information
The published contact details of the person who can answer a Data Principal's questions about processing.
Business contact information is the published way to reach the person who can answer questions about how an organisation handles personal data. Every Data Fiduciary must publish it.
Meaning of Business Contact Information
Every Data Fiduciary must publish business contact information of the DPO (if it has one) or another person who can answer questions about processing. It should be easy to find, usually in the privacy notice and on the website.
Section 8(9) of the DPDP Act requires every Data Fiduciary to publish, in the prescribed manner, the business contact information of its Data Protection Officer, where applicable, or of any other person authorised by it to answer the Data Principal's questions about the processing of her personal data. Section 6(3) adds that a consent request must carry the same contact details. The purpose is practical: people should not have to hunt for someone to ask.
Rule 9 sets the manner. The details must be prominently published on the fiduciary's website or app, and the same information must appear in every response to a communication from a Data Principal exercising her rights under the Act. The Rule does not prescribe a format, but the word "prominently" excludes burying the details in the middle of a long policy or behind several clicks.
"Business" contact information means an official channel: a work email address, a business phone number and a postal address. It does not mean the personal mobile number of an employee. Where the organisation has a DPO, the details are those of the DPO. Where it has none, the organisation picks someone who can answer, such as a privacy lead, a head of compliance or a grievance officer. Naming a role as well as a person is safer, because people change jobs.
The requirement is distinct from, but works with, the grievance mechanism in Section 8(10) and the rights processes in Rule 14. A contact point answers questions about processing; the grievance mechanism resolves complaints; the rights process handles access, correction and erasure requests. Many organisations use a single mailbox for all three, provided that requests are logged and answered within the stated time limits. Sector rules, such as RBI's rules on nodal officers, may also require separate public details.
Examples of Business Contact Information
A small online store lists a privacy email and a named person on its Contact page, and repeats it in its privacy notice.
A store lists a privacy email and the name of its operations manager on the Contact page and in the footer. Its automated reply to rights requests repeats the same details, and a monthly check confirms the mailbox is monitored.
A fintech app shows its contact on the consent screen, in the app's Settings menu and on its website. Because the app is a notified [Significant Data Fiduciary](term/significant-data-fiduciary), the details are those of its India-based DPO.
A school chain publishes a central privacy contact on its website and in the admission handbook, and includes the same contact in letters to parents about data correction, so that families are not sent between campuses.
Why Business Contact Information matters
Missing or unusable contact details undercut every other right. If a customer cannot find where to send a request, the organisation cannot respond on time, the request escalates to the Board, and the Board may treat the failure as a breach of the Act, which falls under the general penalty tier of up to ₹50 crore in the Schedule. Complaint volume to the Board rises when the front door is hard to find.
For businesses it is also a low-cost trust signal. A named, responsive contact shows seriousness, reduces friction with enterprise clients who run vendor reviews, and creates an early warning channel for problems.
How it works in practice
- 1Choose the contact: the DPO for a Significant Data Fiduciary, or a trained privacy lead or grievance officer for everyone else. Record the choice in policy.
- 2Create a dedicated, monitored mailbox and, if useful, a web form that routes into a ticketing tool, so each query is logged, time-stamped and tracked to closure.
- 3Publish the details prominently: footer link on every page, privacy notice, app settings screen, consent request screens and contact page.
- 4Add the details to templates for rights-request replies, grievance responses and breach communications so that Rule 9 is met automatically.
- 5Review the published details every quarter and after reorganisations to ensure they still work, and test them by sending a mock query.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Publishing only a generic "info@" address that nobody monitors for privacy matters. Use a dedicated or routed channel with named owners.
Putting the details only in the full privacy policy. Rule 9 expects prominent display on the website or app.
Forgetting to repeat the details in replies to rights requests.
Listing an individual's personal phone number. Use business channels, and avoid exposing staff unnecessarily.
Compliance tips
Use both a role title and a name, and keep a deputy so the channel works during leave.
Put the contact in the footer template, so it is updated site-wide in one change.
Measure response times and the number of unanswered queries, and report them to management.
Align the contact page with your grievance policy, so users know what happens next and how long it will take.
Common questions about Business Contact Information
What is business contact information under the DPDP Act?
It is the published contact details of the DPO, if there is one, or of another person who can answer questions about how the organisation processes personal data. Section 8(9) and Rule 9 require every Data Fiduciary to publish it.
Where should it be published?
Rule 9 requires prominent publication on the Data Fiduciary's website or app, and in every response to a Data Principal exercising her rights. The footer, privacy notice and consent screens are common placements.
Does the DPDP Act require a named person?
The Act speaks of the DPO or a person authorised to answer questions. A named person is the clearest way to comply, and a role-based mailbox adds continuity. Check the Rules and sector requirements for your case.
Is this the same as a grievance officer?
Not necessarily. The contact point answers questions about processing, while Section 8(10) requires an effective grievance mechanism. Small organisations often use one person for both roles, which is fine if requests are logged and answered on time.