Data Protection Board of India
The independent body that inquires into personal data breaches and complaints and can impose penalties.
The Data Protection Board of India is the independent body that enforces the DPDP Act. It investigates breaches and complaints, can order fixes and imposes penalties.
Meaning of Data Protection Board of India
The Board works as a digital office. It examines personal data breaches, complaints from Data Principals and breaches by Consent Managers, can direct urgent remedial steps, can accept voluntary undertakings, and imposes monetary penalties after an inquiry. Its orders can be appealed to the Appellate Tribunal.
Section 18 establishes the Data Protection Board of India as a body corporate with perpetual succession and a common seal, able to sue and be sued, with headquarters at a place the Central Government notifies. Section 19 provides for a Chairperson and other Members, appointed by the Central Government, who must be persons of ability, integrity and standing with expertise in areas such as data governance, law, technology, dispute resolution or regulation, and at least one must be an expert in law. Sections 20 to 26 deal with terms, disqualification, proceedings and staff.
Rule 17 sets out how members are selected: a Search-cum-Selection Committee chaired by the Cabinet Secretary recommends the Chairperson, and another chaired by the Secretary of the Ministry of Electronics and Information Technology recommends other Members. Rule 18 deals with salary and service terms, Rule 19 with meetings and authentication of orders, and Rule 21 with staff. These Board-related provisions were brought into force when the Rules were notified in November 2025, ahead of the obligations on fiduciaries.
The Board's functions are in Section 27. It acts on an intimation of a personal data breach under Section 8(6), on complaints by Data Principals about breaches or about a fiduciary's failure to meet its obligations or respect rights, on references from governments and court directions, on complaints about Consent Managers and on intimations of breach of registration conditions. It can issue directions, after hearing the person and recording reasons, and later modify, suspend, withdraw or cancel them.
Procedure is in Section 28 and Rule 20. The Board works as a digital office, so complaints, hearings and orders can all be handled online. It decides whether there are sufficient grounds to proceed, then conducts an inquiry following natural justice, with civil-court-type powers to summon people, take evidence and inspect documents. It cannot take equipment that disrupts day-to-day work. It may accept a voluntary undertaking under Section 32, and after an inquiry it can impose a penalty under Section 33. It does not award compensation to individuals, and civil courts have no jurisdiction on matters the Act assigns to the Board under Section 39.
Examples of Data Protection Board of India
A user whose complaint a company ignored can take it to the Board after using the company's grievance process.
A shopper's request to delete her account is ignored for months. After using the retailer's grievance route without result, she files a complaint with the Board. The Board examines the records, hears the retailer and issues directions with a time limit.
A lender detects unauthorised access to a loan database. It tells the Board and affected borrowers without delay, files a detailed report within 72 hours and offers a voluntary undertaking on improved access controls, which the Board considers.
A person files a complaint with the Board to harass a former employer, with invented facts. The Board finds the complaint false and frivolous and imposes costs on the complainant under Section 28(12).
Why Data Protection Board of India matters
For organisations, the Board is where legal risk becomes concrete. Penalties scale with the factors in Section 33(2): the nature, gravity and duration of the breach, the type of data involved, repetition, any gain made or loss avoided, mitigation steps and proportionality. Maximums run from ₹50 crore for general breaches to ₹250 crore for security failures. Two or more penalties can lead to a reference to the Central Government for blocking public access under Section 37.
For individuals, the Board is a low-cost forum that does not require a lawyer or a court visit. Because it operates digitally, a person anywhere in India can lodge a complaint, though she is expected to use the fiduciary's grievance process first.
How it works in practice
- 1Organisations should prepare a Board-readiness folder: policies, records of processing, notices and consents, vendor contracts, security evidence, breach logs and rights-request logs, so that a response to a notice can be assembled quickly.
- 2Assign a single owner for Board communications and set rules for who may speak on the organisation's behalf, with legal review of every submission.
- 3If a breach occurs, inform affected Data Principals and the Board under Section 8(6) and Rule 7 without delay, and file the detailed report within 72 hours. Consider whether a voluntary undertaking under Section 32 suits the case.
- 4Individuals should first write to the fiduciary through its published contact and grievance route, keep copies, and approach the Board only if the matter is unresolved or a breach is involved.
- 5Take note of orders and directions: comply within the stated time, or appeal to the Appellate Tribunal within 60 days if grounds exist.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing the Board decides compensation claims. It can impose penalties paid to the Consolidated Fund of India; it does not award damages to individuals.
Going to a civil court. Section 39 bars civil court jurisdiction over matters the Board is empowered to decide.
Ignoring Board directions while planning an appeal. Directions bind unless modified, suspended or stayed.
Treating the Board as a body to be contacted only after a breach. Early documentation helps your case.
Compliance tips
Track Board orders and public notices as they appear, since they will shape how provisions are read in practice.
Run a mock inquiry exercise once a year: a team requests documents and the owner assembles them within a set time.
Keep evidence of mitigation steps taken after incidents, because Section 33(2)(e) makes timeliness and effectiveness of mitigation relevant to the penalty.
Set up secure, digital-ready submissions, because proceedings are designed to be digital by default.
Common questions about Data Protection Board of India
What is the Data Protection Board of India?
It is the independent body created under Section 18 of the DPDP Act to enforce the law. It inquires into breaches and complaints, can direct urgent remedial action, accepts voluntary undertakings and imposes penalties after an inquiry.
Can an individual complain directly to the Board?
Yes, for a personal data breach or a fiduciary's breach of obligations. A person is generally expected to use the organisation's grievance mechanism first, and complaints that are false or frivolous can draw costs.
Does the Board pay compensation to affected people?
The Act empowers the Board to impose monetary penalties, which are credited to the Consolidated Fund of India. It does not provide for compensation to the Data Principal through the Board.
Can Board orders be challenged?
Yes. Anyone aggrieved by an order or direction of the Board can appeal to the Appellate Tribunal within 60 days under Section 29, in the form prescribed by Rule 22.