Contact Information for Questions About Processing

Paraphrased legal text

A Data Fiduciary shall prominently publish, on its website or app, and shall include in every response to a Data Principal exercising her rights under the Act, the business contact information of the Data Protection Officer (if the Act requires one) or of the person able to answer, on behalf of the Data Fiduciary, a Data Principal's questions about the processing of her personal data. (Paraphrased — see Rule 9 for the exact text.)

What this means in plain English

• A named, reachable contact point is a standalone obligation — not a line in your privacy policy.
• It must be published prominently on the website or app, not buried in a PDF or behind a login.
• The same contact details must be repeated in every reply you send to a rights request.
• If you are a Significant Data Fiduciary you must publish your DPO's business contact; everyone else publishes whoever can actually answer processing questions.
• Business contact details only — this is not an invitation to publish an individual's personal contact information.

Penalty if you get this wrong

Rule 9 sits under the §13 grievance-redressal and principal-rights obligations — up to ₹50 crore for breach of obligations relating to the rights of Data Principals.

How ProtectComply solves it

Grievance Management + Rights Manager (DSR)

• Per-tenant DPO / grievance-contact record, published on the public portals
• Public grievance form at /grievance/[org] with the contact details rendered on the page
• The published contact block is stamped into every DSR and grievance response
• Contact changes are versioned in the audit ledger, so you can show what was published when