Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter VI — Powers, Functions and Procedure to be followed by Board
DPDP Act, 2023 · Chapter VI of IX

Chapter VI: Powers, Functions and Procedure to be followed by Board

Chapter VI sets out what the Data Protection Board can actually do — inquire, direct and penalise — and the procedure it must follow when it does.

Sections 27–28 · 2 sectionsAll 2 sections effective 13 May 2027Reviewed September 2026
Back to the Full DPDP Act GuideChapter VII — Appeal and Alternate Dispute Resolution
  1. 27Powers and Functions of Board
  2. 28Procedure to be Followed by Board

Chapter summary

In plain terms: Section 27 gives the Board its core functions: acting on personal data breach intimations, complaints and references, directing urgent remedial or mitigation measures, inquiring into breaches and imposing penalties. Section 28 requires the Board to work as a digital office and to follow a fair procedure, including giving the affected person a chance to be heard before it decides.

How the sections fit together

Chapter VI describes the Board in action. Section 27 lists what it can do: act on breach intimations, complaints and references, direct urgent remedial steps, inquire, and impose penalties. Section 28 describes how it must do it: as a digital office, by a fair procedure, with a chance to be heard, and with reasons recorded.

For a Data Fiduciary, the combination is a roadmap of a Board proceeding from the first notice to the final order, and the points where you can respond, be heard or seek mediation.

Sections at a glance

Sections 27–28 of the DPDP Act, 2023. Select a section to open its own page, with the full explanation, a worked example and common questions.

Sec. 27Powers and Functions of BoardEffective 13 May 2027

Section 27 is where the Board's enforcement authority actually gets switched on: five specific triggers — breach intimations, Data Principal complaints, Consent Manager breaches, and government references — each giving the Board power to inquire and impose penalties, plus a general power to issue binding directions.

Read the full explanation Sec. 28Procedure to be Followed by BoardEffective 13 May 2027

Section 28 is the Board's own rulebook for how an inquiry actually runs, from the first intimation through to closure or referral for penalty — digital-first process, civil-court-equivalent investigative powers, and specific protections against overreach and against false complaints.

Read the full explanation

Key terms in this chapter

Inquiry
The Board's process of examining a breach or complaint after it decides there are sufficient grounds.
Digital office
A way of working in which the Board receives complaints, holds hearings and issues orders using digital means.
Interim order
A temporary direction the Board can issue while an inquiry is pending.
Remedial measure
A step the Board can direct a Data Fiduciary to take urgently to reduce harm from a breach.
Reference
A request to the Board from the Central Government or a court to inquire into a matter.

Why this chapter matters

This is where the Act's rules turn into enforcement. The chapter is why a breach report, a complaint or a Board reference can lead to an inquiry, and why the process should be taken as seriously as any regulatory proceeding. It also explains the practical rights a Data Fiduciary has during an inquiry.

Who needs to care about this chapter

  • Data Fiduciaries preparing breach-response and regulator-engagement plans.
  • Legal teams advising on how to respond to a Board notice or inquiry.
  • Data Principals who want to know how a complaint will be handled.

Compliance checklist

Practical steps that follow from this chapter. Treat it as a starting point and adapt it to your sector and systems.

  • Name an internal owner for Board correspondence and keep the contact details current.
  • Keep an evidence file for each breach: timeline, decisions, mitigation steps and notifications.
  • Prepare templates for responding to a Board notice within the stated time.
  • Train legal and security teams on the stages of a Board inquiry.
  • Know the mediation and voluntary undertaking options in Chapter VII before an inquiry starts.

Common mistakes to avoid

  • Waiting for a formal notice before collecting breach evidence.
  • Responding late or informally to a Board communication.
  • Ignoring urgent remedial directions on the basis that the inquiry is still open.

Related DPDP Rules

The Act sets the framework and the DPDP Rules, 2025 supply the operational detail. These Rules work with this chapter.

Rule 20 — Board as a Digital Office

Read the Rule

Rule 19 — Procedure for Board Meetings

Read the Rule

Rule 7 — Intimation of Personal Data Breach

Read the Rule

Rule 23 — Calling for Information

Read the Rule

Common questions

Can the Board penalise a company without hearing it?
No. The Board must follow the procedure in Section 28, which includes giving the person concerned an opportunity to be heard and recording reasons for its decision.
Does the Board only act on complaints?
No. It can also act on a personal data breach intimation, on a reference from the Central Government or a court, and in certain cases on its own, as described in Section 27.
Does the Board hold physical hearings?
Section 28 provides for the Board to function as a digital office, so complaints, filings and hearings can take place through digital means.
Can the Board act on its own?
The Board acts on complaints, on personal data breach intimations and on references, and Section 27 sets the cases where it can take steps itself. Read the section page for the exact list.
Does a hearing have to be in person?
No. Under Section 28 and the Rules, the Board functions as a digital office, so filings and hearings can be digital.
What if a complaint is trivial?
The Board can decide that a complaint is false or frivolous and the person who filed it may face a penalty under the Schedule for breach of duties.
Does the Board only act when someone files a formal complaint?
No - sub-section (1) gives it several other triggers too, including a Data Fiduciary's own mandatory breach intimation under Section 8(6), government references, and court directions.
Can a Board direction be changed after it's issued?
Yes - sub-section (3) lets an affected person, or the Central Government, seek modification, suspension, withdrawal or cancellation of a direction.
Can the Board seize our servers or equipment during an inquiry?
No - sub-section (8) specifically prohibits the Board or its officers from taking into custody equipment or items that would adversely affect day-to-day functioning, or from preventing access to premises.
Do we get a chance to respond before the Board issues an interim order against us?
Yes - sub-section (10) requires the Board to give the person concerned an opportunity of being heard, and to record reasons in writing, before issuing an interim order.

Related pages

Chapter VII — Appeal and Alternate Dispute Resolution

The next chapter of the Act.

Read Chapter VII

Chapter V — Data Protection Board of India

The previous chapter of the Act.

Read Chapter V

Full DPDP Act Guide

All 44 sections of the Act, grouped by chapter, with status.

View all chapters

Data Breach

How breach reporting leads into Board action.

Read about breach duties