The Data Protection Board of India is operational. It is processing complaints. And the first enforcement actions tell us something the market was not expecting.
The Board is faster than predicted. Sharper than expected. And less forgiving than most compliance programmes were designed for.
What the first orders reveal
Three patterns are emerging from the Board's early enforcement posture:
First, the Board is treating documentation gaps as evidence of non compliance, not as administrative oversights. An organisation that cannot produce its consent register on demand is treated as an organisation that does not have valid consent. The benefit of doubt does not exist in quasi judicial proceedings.
Second, the Board is examining the substance of consent, not just its existence. Having a consent checkbox is not enough. The Board is looking at the language used, the specificity of purpose, and whether the withdrawal mechanism is genuinely accessible. Form without substance is attracting scrutiny.
Third, breach notification timelines are being enforced strictly. "We were still investigating" is not being accepted as a defence for delayed notification. Section 8(6) says "without delay." The Board is defining that phrase through its orders, and the definition is tighter than most incident response protocols were designed for.
What this means for your organisation
The compliance architecture that survives the Board's scrutiny is the one that was built for enforcement, not for audit. There is a difference. An audit checks whether you have a policy. Enforcement checks whether the policy was actually followed, whether the documentation proves it, and whether the organisation can demonstrate compliance on demand.
"Compliance without conviction is theatre. And the audience is the regulator."
— Anandaday Misshra
Do this now
Request your DPO to produce the consent register, the data map, the breach response protocol, and the vendor DPA register. All four documents. Within 48 hours. If any one of them cannot be produced in that window, that is the gap the Board will find first.