Digital Office
An office that functions by digital means, with proceedings held and records kept electronically.
A digital office is a way of working in which a matter is handled online from the day it is filed to the day it is decided. The Data Protection Board is designed to work like this, so you should rarely need to visit a physical office.
Meaning of Digital Office
The Board is designed to work as a digital office. Complaints, hearings, notices and orders can all be handled online, so a complainant does not have to travel to a physical court.
Section 2 of the Act defines a digital office as one that uses an online mechanism for the whole life of a matter. That runs from receipt of an intimation, complaint, reference, direction or appeal through to its disposal. The definition covers filing, notices, hearings and the final order, not just the first upload. Section 28(1) then says the Board shall, as far as practicable, function as a digital office, with receipt of complaints and the allocation, hearing and pronouncement of decisions being digital by design.
Rule 20 adds the detail. The Board functions as a digital office without prejudice to its power to summon and enforce attendance and to examine any person on oath, and it can adopt techno-legal measures so that proceedings run without anyone being physically present. Rule 22 gives the Appellate Tribunal (TDSAT) the same digital footing for appeals. The words "techno-legal measures" describe how the Board and Tribunal conduct their own work; they are not a list of security controls that a business must install.
A digital office does not mean a weaker or informal one. The Board keeps full inquiry powers under Section 28, including summoning witnesses, taking evidence by affidavit, requiring documents and issuing interim orders after hearing the person concerned. What changes is the channel, not the legal weight. A statement made in a video hearing is still a statement made to a body that can examine you on oath.
Separate this term from its neighbours. "Digital personal data" describes the data the Act protects. A "digital office" describes the regulator's working method. Neither is the same as the online grievance portal that a company runs for its own customers under Section 13, which is the first stop before the Board. Practical details such as the portal address, accepted file formats and fee mechanics are set by the Board and by later notifications, so check them when the Board starts functioning in earnest.
Examples of Digital Office
A [Data Principal](term/data-principal) files a complaint on the Board's portal and attends the hearing by video.
A shopper in Jaipur is refused erasure of her profile by an online store and gets no reply to her grievance. After the fiduciary's response window passes, she files her complaint on the Board's portal with screenshots and attends the hearing from her phone, without engaging a lawyer.
A multi-city hospital group receives an electronic notice from the Board after a breach intimation. Its compliance head uploads the 72-hour report, the incident log and the corrective-action plan through the portal, then joins a video hearing along with the IT security lead.
A fintech start-up with ten staff is summoned over a complaint. Because its evidence is stored by processing activity, it responds on the same day and is able to show that it acted on the user's request within its published timelines.
Why Digital Office matters
For a Data Principal, a digital office lowers the cost of seeking a remedy. A person in a small town in Bihar or Kerala can file a complaint against a company headquartered in Bengaluru without hiring local counsel or travelling. That matters because the Act expects individuals, not only large businesses, to use it. Under Section 13(3) she must first use the fiduciary's own grievance process, and only then approach the Board.
For a Data Fiduciary, the same design means records, responses and evidence will be examined in electronic form. A breach intimation under Section 8(6), a reply to a notice or a compliance report may all be filed and reviewed online. An organisation that cannot produce clean, time-stamped records quickly will find the digital process unforgiving. Penalties after an inquiry can reach ₹250 crore for security failures, so readiness for a remote hearing is part of risk management.
How it works in practice
- 1Keep a single, indexed evidence folder for each processing activity, holding the notice shown, the consent record, the data-flow map, the processor contract and the security-safeguard documentation. Anything you may need to upload to the Board should already exist in a searchable electronic form.
- 2Name an internal owner, usually the grievance officer or the person whose contact details you publish under Section 8(9), who will receive any electronic communication from the Board. Make sure the email address and mobile number registered for this purpose are monitored daily and are not tied to one employee who may leave.
- 3Prepare for remote hearings. Test video-conferencing from the room your team will use, keep identity documents and authority letters in digital form, and decide in advance who speaks for the organisation on technical and legal points.
- 4Maintain a calendar of statutory timelines, such as the 72-hour detailed breach report under Rule 7 and the 60-day appeal window to TDSAT under Section 29. A digital office works to dates, and a missed upload can matter as much as a missed filing.
- 5For individuals, keep copies of your complaint to the fiduciary, its reply, screenshots and any ticket numbers in one place, since the Board will expect proof that you exhausted the grievance step first.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming a digital office is a lighter regulator that can be handled informally. The Board has civil-court-style powers and records its reasons, so treat every online filing as a formal submission.
Believing Rule 20's "techno-legal measures" are security controls your company must buy. They describe how the Board and Tribunal run their proceedings; your own security duties sit in Section 8(5) and Rule 6.
Registering one employee's personal email for Board communication. If that person leaves, a notice can go unread. Use a monitored role-based address instead.
Skipping the fiduciary's grievance process and going straight to the Board as a Data Principal. Section 13(3) expects the first step to be exhausted before the complaint is made.
Compliance tips
Digitise evidence now. If your consent logs, notices and contracts exist only on paper or in scattered inboxes, build a central electronic repository before the main obligations apply on 13 May 2027.
Rehearse a remote inquiry once a year as a tabletop exercise, with legal, IT and customer-support staff taking part, so nobody meets the process for the first time under pressure.
Keep your grievance and contact details current on your website and in every rights-related reply, because the Board will test whether a complainant could actually reach you.
Watch Board notifications and portal guidance for filing formats, fees and language options, and update your internal playbook whenever they change.
Common questions about Digital Office
Is a digital office the same as an online court?
No. It is the Act's name for the way the Board works: complaints, hearings and decisions handled online. The Board is a regulator with inquiry powers, not a court, and its orders can be appealed to the Appellate Tribunal (TDSAT) within 60 days under Section 29.
Will I have to attend the Board in person?
Not as a rule. Section 28(1) and Rule 20 are designed so that proceedings can run digitally without physical presence. The Board still keeps its power to summon people and examine them on oath, so you may be required to attend remotely when asked.
Does the Act require my company to run a digital office?
No. The term describes the Board and the Appellate Tribunal. Your own duties are to publish contact details, run a grievance process and keep records, but the Act does not require you to operate a digital office of your own.
Where do I file a complaint with the Board?
Online, through the Board's digital channel once it is notified and operating. First complain to the Data Fiduciary or [Consent Manager](term/consent-manager) and wait for its response, because Section 13(3) requires you to exhaust that grievance step before approaching the Board.