From complaint to penalty: how the Data Protection Board process works

The penalty caps in the Schedule get the headlines, but they arrive only at the end of a defined pipeline. Sections 27 to 29 set out that pipeline: what starts the Data Protection Board moving, how its inquiry must run, and where its orders can be challenged.

What moves the Board

Section 27(1) lists five triggers. A breach intimation under section 8(6) lets the Board direct urgent remedial or mitigation measures, inquire and impose penalty. A Data Principal's complaint against a Data Fiduciary is the broadest gateway:

"on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;"

Section 27(1)(b) of the DPDP Act 2023.

The remaining triggers cover complaints against Consent Managers, intimations of Consent Manager registration breaches, and Central Government references about intermediaries under section 37(2). The Board can also issue binding directions after a hearing, and can modify, suspend, withdraw or cancel them.

How the inquiry runs

Section 28 makes the Board, as far as practicable, a digital office: receipt of complaints, allocation, hearing and pronouncement are digital by design. The sequence has a filter at the front. The Board first determines whether there are sufficient grounds to proceed; with insufficient grounds it closes the proceedings with recorded reasons. With sufficient grounds it inquires, and the inquiry is bound in one sentence:

"The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry."

Section 28(6) of the DPDP Act 2023.

For the inquiry the Board holds the powers of a civil court: summoning and examining on oath, receiving evidence and requiring production of documents, and inspecting data and records. Two limits protect operations: the Board and its officers may not prevent access to premises or take into custody equipment or items that may adversely affect a person's day to day functioning. Interim orders are possible with recorded reasons after a hearing. On completion, the Board either closes the proceedings or proceeds to penalties in accordance with section 33. And the pipeline guards its own gate: a complaint the Board considers false or frivolous can draw a warning or costs on the complainant.

Where Board orders are challenged

"Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal."

Section 29(1) of the DPDP Act 2023.

The Appellate Tribunal is the TDSAT, the Telecom Disputes Settlement and Appellate Tribunal, borrowed from the telecom regime by the definition in section 2(a). The appeal window is sixty days from receipt of the order, extendable for sufficient cause. The Tribunal is directed to endeavour to dispose of the appeal within six months, recording reasons if it cannot, and it too functions digitally by design. Its orders are executable as decrees of a civil court under section 30, and further appeal follows the route in the Telecom Regulatory Authority of India Act 1997.

The timing picture

The institution and its powers commence separately. The Board itself was established on 13 November 2025 by notification G.S.R. 844(E), and the establishment sections, 18 to 26, are in force. The enforcement pipeline, section 27 except clause (1)(d), and sections 28 to 34, sits in the group due eighteen months from the notification gazette, computed as 13 May 2027; section 27(1)(d), on Consent Manager registration breaches, arrives with the one year group, computed as 13 November 2026. Both computed dates are interpretation until officially confirmed. For organisations, the sequence work is the same either way: the obligations whose breach feeds this pipeline commence on the same computed dates, and the company action plan tool orders that work. For individuals, the rights assistant explains the grievance channel that must be exhausted before the Board is approached.