Rule 9: Contact Information of Person to Answer Questions About Processing
Rule 9 is short and easy to overlook, but it's one of the most commonly missed basics: every Data Fiduciary must publish, visibly, who a Data Principal can actually contact about her data.
Quick summary
What Rule 9 says
- Every Data Fiduciary shall prominently publish, on its website or app, the contact information of its Data Protection Officer, if applicable, or of a person able to answer questions about personal-data processing on the Data Fiduciary's behalf.
- This contact information must also be included in every response to a communication from a Data Principal for the exercise of her rights under the Act.
Breaking it down
Two words carry most of the weight here: “prominently” and “every.”
“Prominently” means findable, not buried. Contact details tucked into paragraph 47 of a privacy policy PDF likely won't meet a “prominent” standard. The expectation is that a Data Principal can find who to contact without hunting.
It's “DPO, or a person” — not every Data Fiduciary needs a formal DPO. Only Significant Data Fiduciaries are required elsewhere in the framework to appoint a Data Protection Officer. Rule 9 doesn't force every business to hire one; it requires publishing contact details for whoever that responsible person is, DPO or not.
“Every response” is a repeated obligation, not a one-time publication. It's not enough to have contact details somewhere on the website once. Every single reply a Data Fiduciary sends to a rights-related request must also include that contact information.
Why this rule matters
This is one of the cheapest rules to comply with and one of the easiest to accidentally miss — a stale “contact us” page that doesn't actually name a responsible person, or a rights-request auto-reply that forgets to include contact details, is a small gap that's very visible to a regulator or a frustrated user.
Real-world example
Who needs to care about this rule
- Every Data Fiduciary, regardless of size — this rule has no size or turnover threshold.
- Whoever owns the website/app footer and privacy-policy page, and whoever drafts rights-request response templates.
Common questions
Do I need to appoint a formal Data Protection Officer to comply with Rule 9?
Where exactly does this contact information need to appear?
Is a generic support email address enough?
Related rules
Rule 8 — Time Period for Specified Purpose to Be Deemed as No Longer Being Served
Read the previous rule in sequence.
Read Rule 8Rule 10 — Verifiable Consent for Processing of Personal Data of Child
Continue to the next rule in sequence.
Read Rule 10Full DPDP Rules Guide
Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.
View all 23 rules