For the purpose of section 22(2)(e) of the Act, every controller must designate a data protection officer from among its staff; it may designate more than one having regard to its structure, size and the complexity and sensitivity of its processing, in which case it designates a lead officer as the primary contact with the Office and data subjects. The controller communicates the officer's particulars to the Office within 14 days of designation and notifies any change of identity or particulars within 14 days of the change. Failure is an offence (fine up to Rs 100,000, up to 5 years). In force 1 January 2027, with a six-month moratorium announced by the Office.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.