Who should own privacy in a company without a privacy team?

Privacy work often lands with whoever is willing to answer the first question. That person may draft the notice, chase vendors and investigate complaints while lacking authority to change a form or stop a campaign. The resulting problem is ownership, even before the business considers a specialist job title.

The DPDP framework distinguishes ordinary fiduciary responsibilities from additional SDF requirements. Sections 8(9) and 8(10) address a contact and grievance mechanism, while section 10 requires a DPO for Significant Data Fiduciaries. As of 22 October 2026, these substantive provisions are scheduled for May 2027. See the Act, final contact rule and commencement notification.

Give the coordinator a defined job

A small company can appoint a privacy coordinator to maintain the workflow map, route requests, organise reviews and track unresolved decisions. This is an internal role design, not a claim that the Act mandates that title for every business.

The coordinator should know which matters they can decide and which require approval. They might correct a broken notice link directly, while a new use of customer data requires the founder and relevant business owner. A possible breach needs a rapid escalation route rather than the next monthly meeting.

Give the role enough time and access to perform its work. Assigning it as an invisible extra duty makes missed handoffs predictable. Even a few scheduled hours and a clear reporting route can be more useful than a grand title without capacity.

Keep operational decisions with the people who run them

Consider a hypothetical eight-person design agency. The operations lead coordinates privacy work. The account manager owns customer collection practices, finance owns invoice-retention decisions, and the technical contractor owns implementation of access changes.

The founder remains the decision-maker for spending, unresolved legal risk and commercial commitments. The coordinator does not personally become responsible for every server setting or supplier promise. Each workflow owner must explain what happens in their area and provide evidence that agreed actions occurred.

This arrangement reflects section 8(1)’s focus on the fiduciary’s responsibility for its processing and processing on its behalf. Appointing a coordinator or buying advice does not move the organisation’s statutory accountability outside the business.

Make the public contact match the internal route

Rule 9 calls for publication of the DPO’s business contact where applicable or a person able to answer processing questions. The contact route should reach someone who can obtain answers, not merely issue an acknowledgement.

A shared role mailbox can provide continuity if access is controlled and a named owner checks it. Publish the route where customers can find it and include it in relevant rights communications as required by the later framework. Avoid claiming there is a dedicated department if there is only one part-time coordinator.

Name a deputy. Test who receives an urgent request when the coordinator is on leave, a contractor’s agreement ends or the founder is travelling. The response plan should not depend on one person’s memory or private inbox.

Establish three escalation paths

First, create an urgent path for suspected incidents. Staff need to know whom to contact immediately and what evidence to preserve. Existing incident obligations can run on short clocks, so a privacy issue should not be trapped in ordinary administrative approval.

Second, create a decision path for new purposes, high-consequence data use and disputed rights requests. The coordinator should assemble facts and identify the question needing approval, rather than circulate an ambiguous request to everyone.

Third, create a capacity path. If a team cannot complete an access review or vendor assessment, someone must decide whether to provide resources, change the activity or accept a documented temporary position where lawful. An overdue spreadsheet entry is not a decision.

Review a small set of evidence

At a regular management check-in, review unresolved requests, recent processing changes, vendor issues, access exceptions and incidents or near misses. Ask for evidence of completion rather than lengthy policy updates.

For the design agency, a useful discussion might concern a former freelancer’s access to a client folder and a new proposal to reuse client contacts for an event. Each item has a different owner and decision, but the same meeting can ensure neither disappears between functions.

The structure should remain understandable when people change roles. Keep responsibilities in the operating guide, update them during onboarding and departure, and make sure each important task has both an actor and an approver. Small-company privacy governance works when somebody can decide, somebody can act and somebody checks the result.