In August 2025 the State Bank of India advertised a contractual post to assist its Data Protection Officer, asking for knowledge of the DPDP Act and a privacy certification. The advertisement shows how one bank has framed the role.
Advertisement CRPD/SCO/2025-26/07, issued from the bank’s Corporate Centre in Mumbai, invited online applications between 25 August and 15 September 2025 for one post of Assistant Data Protection Officer, engaged on contract for three years, with Mumbai as the suggested place of posting.
The advertisement requires a privacy professional certification, and at least ten years of experience at executive or managerial level, including at least one year in data privacy law and regulation and data security. It asks for expert knowledge of data privacy laws, naming the European Union’s General Data Protection Regulation, the UK Data Protection Act 2018 and India’s DPDP Act 2023.
The job profile says the official will assist the Data Protection Officer. The listed duties include developing the bank’s data protection strategy, policy and procedures; periodic data protection audits or reviews; advice on data protection impact assessments; review of records of processing; handling requests from individuals for access to their data; staff training; advice on data protection notices and on obtaining consent; and submission of reports on data privacy laws to top management and the Board.
Under Section 10(2)(a) of the Act, a Significant Data Fiduciary must appoint a Data Protection Officer who represents it under the Act, is based in India, is responsible to its board of directors or similar governing body, and is the point of contact for grievance redressal. Under Section 8(9), every data fiduciary must publish the business contact information of a Data Protection Officer, if applicable, or of a person able to answer questions about the processing of personal data. Rule 9 of the Rules sets out how that contact information is to be published.
Whether a particular bank is a Significant Data Fiduciary depends on a notification under Section 10(1). Sections 8 and 10 of the Act, and Rule 9, come into force in May 2027.
The Forum’s reading, which is its own and has no legal force, is that the advertisement describes a data protection function being staffed ahead of those dates, with reporting to the Board of the kind Section 10 contemplates. It is one advertisement from one bank. It says nothing about any other bank, and the Forum draws no wider conclusion from it.
Compiled 25 September 2026. This entry records published documents. It is not an assessment of any organisation and carries no regulatory force. To report an error or ask for a reply to be recorded, see how the Casebook is compiled.
Back to the Casebook, or read the notes on the Act in the Bulletin.