Data Protection Officer

Per DPDP §10, every Significant Data Fiduciary must have a named, contactable Data Protection Officer (DPO). Even where the venture is not classified as an SDF, we run the DPO function voluntarily because we think it's the right thing to do.

When to contact the DPO

• You suspect a personal data breach involving Maitro
• You want to exercise a DPDP §14 right not satisfied by /trust/dsr
• You disagree with how Maitro has processed your data
• You want clarification on our DPDP commitments
• You are a regulator or court — we welcome the contact

Escalation tree

1. Tier 1 (DPO): privacy@maitro.tech — SLA < 24 hours acknowledgement; 7 days first substantive response.
2. Tier 2 (Grievance Officer): Per DPDP §13. Details at /legal/grievance. SLA 7-day ack.
3. Tier 3 (CEO): Only if Tier 1 + Tier 2 unresponsive beyond their SLAs.
4. Tier 4 (Data Protection Board of India): Statutory regulator under DPDP 2023 once constituted.

What the DPO cannot do

• Provide legal advice on disputes between you and third parties using our service
• Disclose another data principal's information (DPDP §14 limits access to your own data only)
• Override statutory retention (tax, audit, court-ordered preservation)

DPO independence

Maitro is currently operated as a small data fiduciary. If Maitro is notified as a Significant Data Fiduciary, Talpro India will appoint an independent DPO and update this page before the role transfer.