Rule 9Retention, Erasure & Publishing Requirements
Publishing business contact information
What the Rule sets out
Requires the Data Protection Officer's (or equivalent contact person's) name and contact details to be prominently and clearly published on the Data Fiduciary's website or app, in every language in which the notice under Section 5 is offered.
What this means in practice
- A grievance email buried in a PDF privacy policy is not enough — the contact needs to be visible on the site or app itself, matching every language you offer notices in.
Summarised for practical use from the publicly notified DPDP Rules, 2025. Confirm exact clause text against the official Gazette notification before relying on it for compliance decisions.