Skip to main content

Sources last verified on 17 August 2026. Methodology

DPDP Act 2023 · Section 28

Procedure to be followed by Board

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (Publication date 13 November 2025 printed on Gazette issue No. 757, plus eighteen months. The missing space in the phrase "section 6,sections 7 to 10" appears as printed in the Gazette text layer.)
Source
The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) · Gazette page 14
Last verified
17 August 2026
Official requirement · verbatim

Section 28. Procedure to be followed by Board.(1) The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed. (2) The Board may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder. (3) The Board shall determine whether there are sufficient grounds to proceed with an inquiry. (4) In case the Board determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings. (5) In case the Board determines that there are sufficient grounds to proceed with inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any person for ascertaining whether such person is complying with or has complied with the provisions of this Act. (6) The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry. (7) For the purposes of discharging its functions under this Act, the Board shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in respect of matters relating to— (a) summoning and enforcing the attendance of any person and examining her on oath; (b) receiving evidence of affidavit requiring the discovery and production of documents; (c) inspecting any data, book, document, register, books of account or any other document; and (d) such other matters as may be prescribed. (8) The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person. (9) The Board may require the services of any police officer or any officer of the Central Government or a State Government to assist it for the purposes of this section and it shall be the duty of every such officer to comply with such requisition. (10) During the course of the inquiry, if the Board considers it necessary, it may for reasons to be recorded in writing, issue interim orders after giving the person concerned an opportunity of being heard. (11) On completion of the inquiry and after giving the person concerned an opportunity of being heard, the Board may for reasons to be recorded in writing, either close the proceedings or proceed in accordance with section 33. (12) At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant.

Commencement basis · Sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 other than section 27(1)(d), sections 28 to 34, sections 36 and 37, and section 44(2) of the Act

(c) eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.

From commencement notification G.S.R. 843(E), Gazette issue No. 757, printed date 13 November 2025.

Sources cited on this page

  1. [1]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 28, p. 14. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026Section 28 begins on Gazette page 14 and concludes on page 15. The phrase "receiving evidence of affidavit requiring the discovery and production of documents" in clause (b) of sub-section (7) appears as printed. The margin act reference "5 of 1908." printed beside sub-section (7), citing the Code of Civil Procedure, 1908, is not part of the section text and is excluded.
  2. [2]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ · Official requirement · Verified 17 August 2026Notification G.S.R. 843(E) names this section, within sections 28 to 34, in the group that comes into force eighteen months from the date of publication of the notification gazette. The computed calendar date, 13 May 2027, is interpretation until officially confirmed.
  3. [3]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ · Official requirement · Verified 17 August 2026
  4. [4]Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), p. 1. Published 13 November 2025. Official source ↗ · Interpretation, requires judgment · Verified 17 August 2026The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed. It aligns with the derived date for the main group of the DPDP Rules 2025.