How the Board is constituted
The Data Protection Board of India is established by the Central Government under Section 18. Sections 19 to 26 deal with the composition, the appointment and terms of the Chairperson and Members, the conditions of service, and the procedure for meetings. The Board is intended to operate as a digital office, so that complaints and proceedings can be handled without a physical appearance in most matters.
The Board is an adjudicatory body. It is not a policy-maker: rule-making sits with the Central Government, and the Board applies the Act and the Rules to the matters before it.
What the Board does
Section 27 sets out the functions of the Board. In summary, the Board:
- On receiving intimation of a personal data breach, directs urgent remedial or mitigation measures.
- Inquires into a personal data breach and into complaints, and may impose a monetary penalty under the Schedule.
- Inquires into non-compliance with the Act by a Data Fiduciary or Consent Manager.
- Performs other functions assigned to it by the Act or the Rules.
When it imposes a penalty, the Board decides the amount after inquiry, guided by the factors in Section 33(2), within the ceilings set by the Schedule.
How to file a complaint with the Board
A Data Principal who is not satisfied with how a Data Fiduciary or Consent Manager has handled a grievance can approach the Board. The route runs in a set order.
- 01
Exhaust the grievance route first
Under Section 13, raise the matter with the Data Fiduciary or Consent Manager and use its grievance mechanism before approaching the Board.
- 02
Prepare the facts
Set out the personal data involved, what the Data Fiduciary did or failed to do, and the response you received.
- 03
Approach the Board
File the complaint with the Board in the manner set out in Rules 17 to 21, which govern how proceedings are initiated and conducted.
- 04
Inquiry
The Board may inquire, exercising the powers of a civil court under Section 28, and give the parties an opportunity to be heard.
- 05
Order
The Board issues its order, which may include directions and a penalty within the Schedule ceilings.
Appealing a Board order
An order of the Board may be appealed to the Appellate Tribunal under Section 29, in accordance with Rule 22 of the DPDP Rules, 2025. The Telecom Disputes Settlement and Appellate Tribunal functions as the Appellate Tribunal for this purpose.
The Appellate Tribunal follows its own procedure, and its order may in turn be challenged before the higher courts as the law allows.
How AMLEGALS advises before the Board
AMLEGALS is an Indian law firm. Its data privacy practice is led by Anandaday Misshra, Founder and Managing Partner, with Rohit Lalwani, Associate Partner, working on DPDPA compliance.
The team advises Data Fiduciaries facing an inquiry and Data Principals pursuing a complaint, prepares the record, and represents parties through the inquiry and any appeal under Section 29.