Board Inquiry (Adjudication)
The Board’s process of examining a complaint or breach, hearing the parties and deciding the outcome.
Adjudication here means the Board's inquiry process. The Board looks at a complaint or a breach report, hears the people involved and then passes a reasoned order, which may include a penalty.
Meaning of Board Inquiry (Adjudication)
The Board can act on a breach intimation, a complaint from a Data Principal, a reference from the Government or a court direction. It follows natural justice: notice, an opportunity to be heard and a reasoned order. It can issue directions and impose penalties.
Under Section 27, the Board acts on one of five triggers: a breach intimation from a Data Fiduciary under Section 8(6); a complaint by a Data Principal about a breach of her rights or the fiduciary's obligations, or a reference by the Government or a direction of a court; a complaint about a Consent Manager; an intimation that a Consent Manager has breached its registration conditions; and a reference from the Central Government about an intermediary under Section 37(2). The Board's powers include inquiry and imposing penalties, and it can also issue directions after a hearing.
Section 28 prescribes the procedure. The Board functions, as far as practicable, as an independent digital office, so receipt of complaints, hearings and orders are digital. On receiving a matter it first decides whether there are sufficient grounds to proceed. If not, it closes the matter and records reasons. If yes, it inquires following principles of natural justice, which means notice, a chance to respond, a hearing and reasons in writing. It has the powers of a civil court to summon witnesses, take evidence on oath and inspect documents, but it cannot take custody of equipment in a way that would disturb day-to-day operations.
The process has built-in safeguards and timelines. The Board can issue interim orders, but only after hearing the person concerned. Rule 19 requires it to complete an inquiry within six months of receiving the intimation, complaint, reference or direction, with extensions of up to three months at a time, recorded in writing. At the end it either closes the proceeding or goes on to impose a penalty under Section 33, again after a hearing. If a complaint is false or frivolous, the Board can warn or impose costs on the complainant.
Adjudication ends in an order, and orders can be challenged. A person aggrieved can appeal to the Appellate Tribunal under Section 29 within sixty days, and Rule 22 describes the digital filing and fee. The Board may also direct the parties to mediation under Section 31 where it thinks the complaint is suited to it, and it may accept a voluntary undertaking under Section 32 at any stage. Civil courts are barred from deciding matters the Board can decide, by Section 39.
Examples of Board Inquiry (Adjudication)
The Board receives a breach report, issues a notice to the fiduciary, hears it and passes an order.
A customer of a food-delivery app asks for deletion of her account and gets no response beyond the ninety-day period. She files a complaint with the Board, which decides there are sufficient grounds, issues a notice and hears both sides before passing an order.
A diagnostic lab reports a breach to the Board under Section 8(6). The Board starts an inquiry, directs urgent remedial steps by an interim order after a hearing, and concludes after reviewing the lab's logs and notification records.
A person files a complaint against a coaching centre to harass it, without any real basis. The Board finds the complaint false and frivolous and, under Section 28, can warn or impose costs on the complainant.
Why Board Inquiry (Adjudication) matters
Adjudication is how the Act gets its force. Rights and duties on paper mean little unless some body can find the facts and order a remedy, and the Board performs this role. For a fiduciary, an inquiry means document requests, a demand to explain, and potential penalty exposure up to the Schedule ceilings. For a Data Principal, it is the route to follow when the fiduciary's own grievance process has failed.
The approach is more informal and faster than civil litigation, but not casual. Statements made to the Board can be relied on later, and evidence will be examined in detail. Organisations that treat a Board notice as routine correspondence tend to miss deadlines and lose points on mitigation.
How it works in practice
- 1A Data Principal should first raise the matter with the fiduciary through its published grievance route and wait for the response period (a reasonable time not exceeding ninety days under Rule 14). The Act expects this step before approaching the Board.
- 2If unresolved, she files a complaint with the Board through its digital office, giving the facts, the data involved and the earlier correspondence. The Board then decides whether there are sufficient grounds.
- 3On receipt of a Board notice, a fiduciary should log the dates, appoint a lead, preserve all relevant records and logs, and prepare a response that sets out facts, the safeguards in place and the remedial steps taken.
- 4During the inquiry the parties attend digital hearings, produce documents and may be examined. The fiduciary should make sure the witnesses are well prepared, because the Board has the powers of a civil court to take evidence.
- 5After the order, comply with directions, pay any penalty, or appeal within sixty days to the Appellate Tribunal under Section 29. Record the outcome and the changes made to prevent a recurrence.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Going to the Board first. The Act expects the Data Principal to use the fiduciary's grievance redressal first.
Treating the Board notice casually and missing deadlines, which lowers credibility and weakens the mitigation argument.
Thinking a civil suit can run in parallel on the same issue. Section 39 bars civil courts from matters the Board can decide.
Forgetting the appeal window of sixty days under Section 29.
Compliance tips
Keep a litigation-ready record: logs, consent artefacts, vendor contracts and incident timelines stored in a form you can produce quickly.
Train the grievance team to recognise complaints that could go to the Board and to escalate them to legal.
Prepare a standard response template for Board notices that lists facts, safeguards, timeline and corrective steps.
Check Rule 20 arrangements for digital hearings so your team has the right technology and access.
Common questions about Board Inquiry (Adjudication)
What is the process before the Data Protection Board?
The Board receives a breach report, complaint, reference or court direction, decides if there are sufficient grounds, inquires under natural justice, may issue interim orders, and then closes the case or imposes a penalty after a hearing. All of this is digital where practicable.
How long does a Board inquiry take?
Rule 19 requires completion within six months of receipt of the matter, with written extensions of up to three months at a time. Complex matters may take longer, but extensions have to be recorded with reasons.
Can I go to a civil court instead of the Board?
No, for matters the Board is empowered to decide. Section 39 bars civil courts from entertaining such suits. You may appeal a Board order to the Appellate Tribunal within sixty days under Section 29.