Inside the Data Protection Board of India: How Complaints Become Penalties

Who this is for: legal counsel, DPOs and compliance leaders who need to understand how enforcement under the DPDP Act will actually work.

Every penalty under the DPDP Act passes through one body: the Data Protection Board of India. Understanding how it starts inquiries, what it can do and how its process runs is essential to understanding real risk, and to responding well if your organisation is ever before it.

What the Board is

The Board is established under Section 18 of the Act as an independent body. It consists of a Chairperson and members appointed by the central government; the government has fixed the strength at a Chairperson and four Members. It is designed as a digital office: complaints, proceedings, hearings and orders are intended to be conducted digitally, with techno-legal measures, under Section 28 and Rules 17 to 21.

The Board was established on 13 November 2025, when its provisions came into force. MeitY invited applications for the Chairperson and Members in May 2026. Its powers over the obligations of businesses apply from 13 May 2027, as explained in our DPDP compliance timeline.

The Board is an adjudicator, not a general regulator. It does not issue codes of practice or guidance in the way some data protection authorities do. Its role is to decide cases.

How a case starts

Under Section 27, the Board can act on:

• a breach intimation from a Data Fiduciary under Section 8(6) and Rule 7
• a complaint from a Data Principal, after exhausting the fiduciary's grievance mechanism (Section 13(3))
• a reference from the central government or a state government
• a direction from a court
• a complaint about a breach by a Consent Manager, or of a Consent Manager's registration conditions

The requirement that individuals use your grievance process first matters. A well-run rights and grievance process resolves most issues before they reach the Board.

How an inquiry runs

Under Section 28, the Board first decides whether there are sufficient grounds to proceed. If not, it closes the matter, recording its reasons. If there are, it conducts an inquiry, following principles of natural justice and giving the organisation an opportunity to be heard.

During the process, the Board can:

• issue interim orders where needed
• direct the parties to attempt mediation (Section 31)
• accept a voluntary undertaking from the organisation to take, or refrain from, specified actions (Section 32), which can bar further proceedings on that matter
• issue directions to the organisation, for example to take urgent measures after a breach

It also has powers of a civil court for summoning and examining persons and inspecting documents, but cannot prevent access to premises or take custody of equipment in a way that adversely affects the day-to-day functioning of a person.

Outcomes

If the Board finds a significant breach, it can impose a penalty under Section 33 and the Schedule, up to ₹250 crore per instance, taking into account the factors in Section 33(2), including the timeliness and effectiveness of any mitigation. See DPDP Act penalties.

Where penalties have been imposed on a fiduciary in two or more instances, the Board can advise the central government to block public access to that fiduciary's platform, and the government may do so after giving an opportunity to be heard (Section 37).

Penalties are credited to the Consolidated Fund of India. The Act does not provide for compensation to affected individuals.

Appeals

An organisation or individual aggrieved by a Board order can appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (Section 29). Further appeal lies to the Supreme Court. Civil courts have no jurisdiction over matters the Board is empowered to decide.

What this means for your preparation

• Evidence wins. The Board decides on records. Consent logs, notice versions, request histories and breach timelines are your case.
• Grievances are the front door. Most complaints must pass through your process first. Handle them well and fewer reach the Board.
• Speed counts. Timely mitigation and honest breach reporting directly affect penalties.
• Undertakings are a tool. A credible, early voluntary undertaking can resolve a matter without a penalty.

How ConsentifyAI helps

ConsentifyAI keeps the records the Board is most likely to ask for: consent and notice histories, rights and grievance timelines, breach actions and configuration changes, all in a tamper-evident audit trail. If an inquiry starts, you can produce a complete, consistent account quickly.