Section 27: Powers and Functions of Board

Quick summary

What Section 27 says

• Sub-section (1) — the Board exercises the following powers and functions:
• Clause (1)(a) — on receipt of intimation of a personal data breach under Section 8(6), to direct any urgent remedial or mitigation measures, and to inquire into the breach and impose penalty as provided in the Act.
• Clause (1)(b) — on a complaint by a Data Principal regarding a personal data breach, or a breach by a Data Fiduciary of its obligations relating to her personal data or the exercise of her rights, or on a reference by the Central or a State Government, or in compliance with a court's directions, to inquire into such breach and impose penalty.
• Clause (1)(c) — on a complaint by a Data Principal regarding a breach by a Consent Manager of its obligations relating to her personal data, to inquire into the breach and impose penalty.
• Clause (1)(d) — on receipt of intimation of a breach of any condition of registration of a Consent Manager, to inquire into the breach and impose penalty.
• Clause (1)(e) — on a reference by the Central Government regarding a breach of Section 37(2) by an intermediary, to inquire into the breach and impose penalty.
• Sub-section (2) — for the effective discharge of its functions, the Board may, after giving the person concerned an opportunity of being heard and recording reasons in writing, issue such directions as it considers necessary to that person, who shall be bound to comply.
• Sub-section (3) — on a representation by a person affected by a direction issued under sub-section (1) or (2), or on a reference by the Central Government, the Board may modify, suspend, withdraw or cancel that direction, imposing conditions as it thinks fit.

Breaking it down

Five entry points, one enforcement toolkit. Whether the Board's involvement starts with a self-reported breach, an aggrieved individual's complaint, a government referral, a court order, or a Consent Manager-specific issue, sub-section (1) gives it the same basic power in each case: inquire, then impose a penalty as the Act provides.

Clause (a) is the only trigger tied to a Data Fiduciary's own proactive obligation. The Section 8(6) breach-intimation requirement means a Fiduciary reporting its own breach is itself what starts a Board inquiry — alongside the Board's power to direct urgent remedial or mitigation measures immediately, before the inquiry even concludes.

Clauses (b) and (c) split complaint-handling between Data Fiduciaries and Consent Managers specifically. A Data Principal's complaint about a Fiduciary's breach follows one clause, while a complaint specifically about a Consent Manager's conduct follows a separate, dedicated clause — reflecting that Consent Managers occupy a distinct role from ordinary Data Fiduciaries.

Directions under sub-section (2) are a distinct, general power, not tied to any single one of the five triggers. This is the Board's broader authority to issue binding directions necessary for effectively discharging its functions generally — always subject to the same procedural safeguard: a hearing first, and written reasons recorded.

Directions aren't necessarily permanent. Sub-section (3) gives both affected persons and the Central Government a route to seek modification, suspension, withdrawal or cancellation of a direction — a built-in mechanism for the Board's own orders to be revisited as circumstances change, without necessarily requiring a formal appeal.

Why this section matters

Section 27 is the section that actually gives the Board teeth. Chapters II and III create obligations and rights; Section 27 is what lets the Board act when those obligations aren't met — whether that's responding urgently to an active breach, resolving an individual's complaint, or acting on referrals from courts and government. Understanding these five specific triggers matters for knowing exactly how a Board inquiry against your organisation is likely to start.

Real-world example

Who needs to care about this section

• Compliance and legal teams — understanding these five specific triggers helps anticipate how and why a Board inquiry might start.
• Consent Managers — clauses (c) and (d) create Board oversight specific to their registered role, distinct from ordinary Data Fiduciary obligations.
• Anyone who has received a Board direction — sub-section (3) is the route to seek its modification or withdrawal.

Common questions

Related sections