From complaint to penalty: how the Data Protection Board process works

The penalty caps in the Schedule get the headlines, but they arrive only at the end of a defined pipeline. Sections 27 to 34 of the DPDP Act 2023, with Rules 19 to 22 of the DPDP Rules 2025, set out that pipeline: what starts the Data Protection Board moving, how its inquiry must run, the 7 matters that decide how large a penalty is, where the order can be challenged, and what the text does and does not say about collecting the money. Every step below is cited to the Gazette, and every step for which the text fixes no period is marked as such, because that turns out to be almost all of them.

Diagram headed "From complaint to penalty: the 5 steps, and not 1 of them is in force yet", subtitled that section 13 and the pipeline in sections 27 to 34 are drafted law that has not commenced while sections 18 to 26 and Rule 19 are law today. A NOT IN FORCE TODAY marker, read as at 3 September 2026, puts sections 13 and 27 to 34, bar 1 clause, in the 18 month group, computed 13 May 2027 and labelled interpretation until officially confirmed. 5 numbered steps, left to right. Step 1, Grievance, typed to section 13(1) and 13(3) as the grievance route: the Data Principal must exhaust the grievance route a Data Fiduciary or Consent Manager must provide. Step 2, Complaint: a Data Principal's complaint, an intimation, reference or court direction reaches the Board, typed to section 27(1) with section 28(2) as 5 triggers, none timed. Step 3, Inquiry: sufficient grounds first, then inquiry on the principles of natural justice, with civil court powers, typed to sections 28(3) to 28(7), Rule 19(9) allowing 6 months. Step 4, Order: after a hearing, close the proceedings, or a penalty needing a significant breach, set on section 33(2)'s 7 matters, typed to sections 28(11) and 33(1) with no period in the text. Step 5, Appeal, in green because the forum changes: to the Appellate Tribunal, the TDSAT by the section 2(a) definition, where the 6 months is the Tribunal's own endeavour, typed to sections 29(2), 29(3) and 29(6) as 60 days, late on cause. A panel beneath splits the basis. In the instruments' own words it quotes G.S.R. 843(E) paragraph (c), bringing sections 11 to 17, section 27 except clause (d) of sub section (1) and sections 28 to 34 into force eighteen months from publication of that gazette; section 13(3) on exhausting the grievance opportunity before approaching the Board; Rule 19(9) on completing the inquiry within six months of receipt unless extended for reasons recorded in writing for a further period not exceeding three months at a time; and section 33(1) on the Board's power, on conclusion of an inquiry and after a hearing, to impose a monetary penalty specified in the Schedule where it determines the breach is significant. Under this site's reading: step 1 is the gate section 13(3) puts before the complaint route, so for a Data Principal the Board is the last port of call, not the first, and the gate binds her alone, since a government reference, a court direction and a breach intimation are not; across sections 26 to 34 the Act fixes 2 periods and neither binds the Board, 60 days for the person to appeal and 6 months for the Tribunal's endeavour to decide, so the only period on the Board's own inquiry is in the Rules; neither instrument defines significant, a word the Act uses once outside the defined term Significant Data Fiduciary; and section 27(1)(d), on an intimation of breach of a Consent Manager's registration conditions, is the 1 trigger in paragraph (b)'s 1 year group, computed 13 November 2026, likewise interpretation until officially confirmed, while Rule 19 is in force and section 28 is not, so the 6 months has nothing to time yet. A source line beneath cites sections 2, 13 and 26 to 34 of the DPDP Act 2023, Rule 19 of the DPDP Rules 2025 and notification G.S.R. 843(E).

Read as at 3 September 2026, not 1 of those 5 steps is a live duty or a live power. Clause (c) of notification G.S.R. 843(E) puts every Act provision that creates those steps into the group that comes into force "eighteen months from the date of publication of this gazette", bar the single clause it carves out on its face, and it names them in the instrument's own enumeration, alongside the other provisions in that group: "sections 11 to 17", which is where section 13 sits, "section 27 except clause (d) of sub-section (1) of the said section", and "sections 28 to 34". That 18 month date is computed here as 13 May 2027 and is interpretation until officially confirmed. Section 27(1)(d) arrives a year earlier under clause (b), computed as 13 November 2026, likewise interpretation until officially confirmed. What is in force is the institution rather than its pipeline: sections 18 to 26 came into force under clause (a) on the printed publication date of that gazette, 13 November 2025, and the Board was established the same day by a separate notification, G.S.R. 844(E), made under sub sections (1) and (3) of section 18, because bringing section 18 into force does not itself establish the Board: section 18(1) makes the establishment take effect from a date the Central Government appoints by a notification of its own. Rules 1, 2 and 17 to 21, which carry the meeting procedure and the 6 month inquiry period in Rule 19(9), came into force on publication under Rule 1(2). The timing picture at the end of this article sets out that split provision by provision.

The whole process in 1 table

Read down the third column first. Across sections 26 to 34 the Act fixes exactly 2 periods, and both of them belong to somebody other than the Board: the 60 days a person gets to appeal, and the 6 months in which the Appellate Tribunal is to endeavour to decide. The single period bearing on the Board's inquiry is in the Rules, not the Act. That enumeration was checked against the Gazette text of the Act and the English section of the DPDP Rules 2025 as corrected on 24 August 2026.

2 things to take from the blanks. First, an organisation that receives a Board notice cannot read a deadline for the Board out of the Act; the only clock over the Board's inquiry is the Rule 19(9) period, and that period is extendable by recorded reasons with no stated limit on the number of extensions. Second, neither of the periods that do exist binds the Board: the 60 days in section 29(2) runs against the person, and the 6 months in section 29(6) is an endeavour the sub section places on the Appellate Tribunal, "by it", and not on anybody appearing before it. Only 1 of the 2 can be missed by a party, and missing it means relying on the Tribunal's discretion under section 29(3); the 6 months can be exceeded too, but section 29(7) answers that with a duty on the Tribunal to record its reasons in writing and not with any loss of the appeal.

What moves the Board

Section 27(1) lists 5 triggers. A breach intimation under section 8(6) lets the Board direct urgent remedial or mitigation measures, inquire and impose penalty. A Data Principal's complaint against a Data Fiduciary is the broadest gateway:

"on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;"

Section 27(1)(b) of the DPDP Act 2023.

The remaining triggers cover complaints against Consent Managers, intimations of Consent Manager registration breaches, and Central Government references about intermediaries under section 37(2). The Board can also issue binding directions after a hearing, and can modify, suspend, withdraw or cancel a direction, though section 27(3) opens that route only on a representation by a person affected by the direction or on a Central Government reference.

There is a gate in front of that gate. Section 13(3) is 1 sentence:

"The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board."

Section 13(3) of the DPDP Act 2023, Gazette page 10.

So the complaint route in section 27(1)(b) is not drafted as a first port of call. Section 13(3) sends the individual through the Data Fiduciary's own grievance mechanism first, and Rule 14(3) names "within a reasonable period not exceeding ninety days" in a sentence printed with no object for "publish", so what the 90 days caps is not stated on its face; this site reads it as the published response period. Section 13 and Rule 14 sit in the same 18 month commencement group as the enforcement provisions, so neither is in force yet, and the grievance redressal guide sets out that channel in detail. The consequence for an organisation, once it all commences, is that its own grievance queue is where Board exposure will be either defused or created: a grievance answered inside the published period does not become a section 27(1)(b) complaint.

How the inquiry runs

Section 28 makes the Board, as far as practicable, a digital office: receipt of complaints, allocation, hearing and pronouncement are digital by design. The sequence has a filter at the front. The Board first determines whether there are sufficient grounds to proceed; with insufficient grounds it closes the proceedings with recorded reasons. With sufficient grounds it inquires, and the inquiry is bound in 1 sentence:

"The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry."

Section 28(6) of the DPDP Act 2023.

For the inquiry the Board holds the powers of a civil court: summoning and examining on oath, receiving evidence and requiring production of documents, and inspecting data and records. 2 limits protect operations: the Board and its officers may not prevent access to premises or take into custody equipment or items that may adversely affect a person's day to day functioning. Interim orders are possible with recorded reasons after a hearing. On completion, the Board either closes the proceedings or proceeds to penalties in accordance with section 33. And the pipeline guards its own gate: a complaint the Board considers false or frivolous can draw a warning or costs on the complainant.

Section 28 runs to 12 sub sections. Laid out in order they show both the shape of the process and the shape of what is absent from it.

12 sub sections and 12 blanks. Section 28 tells the Board how to conduct itself and never once tells it when.

What the civil court powers actually are. This is the sub section organisations most often hear about second hand, so it is worth reading whole:

"For the purposes of discharging its functions under this Act, the Board shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in respect of matters relating to— (a) summoning and enforcing the attendance of any person and examining her on oath; (b) receiving evidence of affidavit requiring the discovery and production of documents; (c) inspecting any data, book, document, register, books of account or any other document; and (d) such other matters as may be prescribed."

Section 28(7) of the DPDP Act 2023, Gazette page 15.

3 precise points. The Board is not made a civil court; it is given a civil court's powers in respect of the named matters. Clause (b) is quoted exactly as printed, including the phrase "receiving evidence of affidavit", which this site neither corrects nor construes. And clause (d) is a prescription hook: clause (w) of section 40(2) carries the power to prescribe those other matters, and no rule in the 2025 set takes it up, checked on 24 August 2026. That is an observation about the 2025 set, not about future rules, because section 40(1) is a general rulemaking power and section 40(2) opens "In particular and without prejudice to the generality of the foregoing power".

The 2 things the Board may not do. Section 28(8) is a single sub section carrying 2 prohibitions, and it is the only limit in the section aimed at keeping a business running while an inquiry proceeds:

"The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person."

Section 28(8) of the DPDP Act 2023, Gazette page 15.

Read against section 28(7) the division is legible: the Board can compel attendance, evidence and inspection, and section 28(8) withholds preventing access to premises and taking equipment or items into custody, in each case as qualified by the closing words the sub section prints once at its end. 2 cautions on how far that goes. The closing words, "that may adversely affect the day-to-day functioning of a person", are printed at the end of the sub section, and whether they qualify both limbs or only the taking into custody is a question of grammar the text does not settle; this site does not resolve it. And section 28(8) says nothing about inspection, so it does not cut down section 28(7)(c), which reaches "any data, book, document, register, books of account or any other document".

Who else can be pulled in. Section 28(9) lets the Board require the services of any police officer, or any officer of the Central Government or a State Government, to assist it for the purposes of that section, and places a duty on every such officer to comply with the requisition. It is the provision that gives an inquiry reach beyond the Board's own staff.

The only clock over the Board's inquiry: Rule 19(9)

The Act fixes no period for any step the Board takes. The Rules fix exactly 1 on the inquiry, and it is buried in a rule whose heading is about meetings:

"The inquiry by the Board shall be completed within a period of six months from the date of receipt of the intimation, complaint, reference or direction under section 27 of the Act, unless such period is extended by it, for reasons to be recorded in writing, for a further period not exceeding three months at a time."

Rule 19(9) of the DPDP Rules 2025, Gazette page 31.

4 features of that sentence matter to anyone under inquiry.

1. The clock starts at receipt, not at the start of the inquiry. The 6 months run from the date the triggering intimation, complaint, reference or direction reaches the Board, so the section 28(3) sufficient grounds decision and the inquiry itself both have to fit inside the same 6 months.
2. The extension is by the Board, on its own recorded reasons. No application, no consent, no external approval appears in the text.
3. Each extension is capped at 3 months. The number of extensions is not. The sub rule limits the length of each extension, states no maximum number of them, and its words "at a time" contemplate more than 1. That the proceeding as a whole therefore carries no outer limit follows from there being no such limit anywhere else in the Act or the Rules, checked on 24 August 2026, rather than from this sub rule alone.
4. It sits in a rule about meetings. Rule 19 carries the heading "Procedure for meetings of Board and authentication of its orders, directions and instruments", and the inquiry period is its ninth and last sub rule. It is easy to miss for exactly that reason.

There is a commencement oddity here worth naming, because it cuts the other way from most of this article. Rule 19 is already in force. Rule 1(2) brings Rules 1, 2 and 17 to 21 into force on the date of publication, printed 13 November 2025, while section 27 except clause (1)(d), section 28 and section 33 sit in the group that arrives 18 months later, and section 27(1)(d) arrives with the 1 year group. So the 6 month inquiry period is law today, and on this site's reading it has nothing to time until the inquiry power in section 28 commences. The 1 year date complicates that rather than settling it: from that date an intimation under section 27(1)(d) can be received, and receipt is the event Rule 19(9) times from, while section 28 is still not in force. That reading is interpretation; nothing in either text addresses the overlap.

Who actually conducts the proceeding

The provisions that answer this are the ones already in force, which makes them the most concrete part of the picture.

Section 26 gives the Chairperson 2 powers that shape the front of the pipeline:

"(b) authorise any officer of the Board to scrutinise any intimation, complaint, reference or correspondence addressed to the Board; and (c) authorise performance of any of the functions of the Board and conduct any of its proceedings, by an individual Member or groups of Members and to allocate proceedings among them."

Section 26 of the DPDP Act 2023, Gazette page 14.

So the first human being to read a complaint may be an officer rather than a Member, and a proceeding may be conducted by 1 Member. "The Board" in section 28 does not imply the full Board sitting on every matter.

Rule 19 supplies the collective mechanics where the Board does sit: the quorum is "One-third of the membership of the Board", questions are decided by a majority of Members present and voting with a second or casting vote on an equality, and a Member who has an interest in an item of business may not participate in or vote on it. Rule 20 states the digital office duty in flatter terms than section 28(1) does, without the qualification "as far as practicable":

"The Board shall function as a digital office, without prejudice to its power to summon and enforce the attendance of any person and examine her on oath, may adopt techno-legal measures to conduct proceedings in a manner that does not require physical presence of any individual."

Rule 20 of the DPDP Rules 2025, Gazette page 31.

1 practical note on the state of the institution rather than the text: as of a MeitY circular dated 6 May 2026, applications were being invited for 1 post of Chairperson and 4 posts of Member of the Board, for a panel to be put to a Search cum Selection Committee. That is reporting of an official document, not a legal claim. Section 26 and Rule 19 are in force; what they need in order to operate is people in the offices they describe.

When the Board can act without an inquiry

A monetary penalty cannot skip the inquiry. Section 33(1) makes the determination one taken "on conclusion of an inquiry", and that is the printed text. Several other things the Board can do are not tied to a completed inquiry, and an organisation dealing with the Board should know which is which.

The right column is this site's reading of the printed words in each case, not a statement in the Act that an inquiry may be dispensed with; no provision says that in terms. The settlement route in section 32 is covered separately in voluntary undertakings under section 32, and it is the route worth understanding before an inquiry starts rather than during one.

The 7 matters that decide how large a penalty is

This is the part of the enforcement process that almost no summary covers, and it is the part an organisation facing an inquiry actually needs. The Schedule gives a ceiling. Section 33(2) gives the Board its instructions for choosing a number under that ceiling, and it prints exactly 7 of them:

"While determining the amount of monetary penalty to be imposed under sub-section (1), the Board shall have regard to the following matters, namely:— (a) the nature, gravity and duration of the breach; (b) the type and nature of the personal data affected by the breach; (c) repetitive nature of the breach; (d) whether the person, as a result of the breach, has realised a gain or avoided any loss; (e) whether the person took any action to mitigate the effects and consequences of the breach, and the timeliness and effectiveness of such action; (f) whether the monetary penalty to be imposed is proportionate and effective, having regard to the need to secure observance of and deter breach of the provisions of this Act; and (g) the likely impact of the imposition of the monetary penalty on the person."

Section 33(2) of the DPDP Act 2023, Gazette page 17.

4 observations from the printed words.

The words are "shall have regard to". Not may. All 7 matters attach to every determination of an amount, and there are exactly 7. What the sub section does not supply is any weighting between them, any starting point, any multiplier and any arithmetic. Neither the Act nor the Rules sets out a tariff, checked on 24 August 2026.

Only 1 of the 7 is still in your hands after a breach. Clauses (a), (b) and (c) describe the breach; (d) describes what you got out of it; (f) and (g) describe the penalty rather than your conduct. Clause (e) is the single limb that responds to what you do after you find out, and it is written in 3 parts: whether you acted, how timely the action was, and how effective it was. That makes an evidenced response part of the statutory calculation rather than a matter of goodwill.

"Significant" is the gate before the amount. Section 33(1) lets the Board impose a penalty only if it determines that the breach "is significant". Outside the defined term "Significant Data Fiduciary", the word significant appears exactly once in the Act, in section 33(1), and is defined in neither section 2 of the Act nor Rule 2 of the Rules, verified on 24 August 2026. So a breach the Board does not find significant attracts no monetary penalty, and what makes a breach significant is not written down.

The duty in section 33(2) is on the Board. Nothing in the Act or the Rules requires a person under inquiry to file, prepare or produce anything addressed to these 7 matters. That is a reason to prepare it anyway, offered here as a recommendation rather than a requirement: an inquiry is where clauses (a), (c) and (e) get established as facts, and a dated record of when you detected a breach, what you did, when, and what it achieved is either available then or it is not.

The caps that these 7 matters operate under live in the Schedule, and they are set out with each entry in the penalties and Schedule guide. This article does not restate them.

Where Board orders are challenged

"Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal."

Section 29(1) of the DPDP Act 2023.

The Appellate Tribunal is the TDSAT, the Telecom Disputes Settlement and Appellate Tribunal, borrowed from the telecom regime by the definition in section 2(a). The appeal window is 60 days from receipt of the order, extendable for sufficient cause. The Tribunal is directed to endeavour to dispose of the appeal within 6 months, recording reasons if it cannot, and it too functions digitally by design. Its orders are executable as decrees of a civil court under section 30, and further appeal follows the route in the Telecom Regulatory Authority of India Act 1997.

The borrowing is not left to the definition alone. Section 44(1) amends clause (c) of section 14 of the Telecom Regulatory Authority of India Act, 1997 to add "the Appellate Tribunal under the Digital Personal Data Protection Act, 2023" to the tribunals that provision names, and section 44(1) is already in force under paragraph (a) of notification G.S.R. 843(E), while sections 29 and 30 are not.

The 60 days, precisely. The period is fixed in 1 sentence:

"Every appeal under sub-section (1) shall be filed within a period of sixty days from the date of receipt of the order or direction appealed against and it shall be in such form and manner and shall be accompanied by such fee as may be prescribed."

Section 29(2) of the DPDP Act 2023, Gazette page 15.

The trigger is receipt of the order or direction, not the date on the order, which matters when a digital pronouncement and its delivery fall on different days. Section 29(3) lets the Tribunal entertain a late appeal "if it is satisfied that there was sufficient cause for not preferring the appeal within that period", and states no outer limit on that discretion. Section 29(4) sets out what the Tribunal may then do: after giving the parties an opportunity of being heard, pass such orders as it thinks fit "confirming, modifying or setting aside the order appealed against".

Form, manner and fee. Section 29(2) leaves all 3 to be prescribed, and clause (x) of section 40(2) carries the power in exactly those words: "the form, manner and fee for filing an appeal under sub-section (2) of section 29". Rule 22 is where all 3 are supplied, though the Rules cite section 40 generally rather than clause by clause, so the pairing is a reading. Rule 22(1) requires the appeal to be filed "in digital form as the Appellate Tribunal may decide". Rule 22(2) fixes the money:

"An appeal filed with the Appellate Tribunal shall be accompanied by fee of like amount as is applicable in respect of an appeal filed under the Telecom Regulatory Authority of India Act, 1997 (24 of 1997), unless reduced or waived by the Chairperson of the Appellate Tribunal at her discretion, and the same shall be payable digitally using the Unified Payments Interface or such other payment system authorised by the Reserve Bank of India."

Rule 22(2) of the DPDP Rules 2025, Gazette page 31.

So the DPDP framework sets no fee figure of its own. It points at the fee already applicable to a telecom appeal, makes it reducible or waivable at the discretion of the Tribunal's Chairperson, and requires digital payment. This site does not state what that fee amount is: the Telecom Regulatory Authority of India Act, 1997 and the rules under it are not verified against an on file official extraction here.

There is no deposit. The idea that a person must put down part of the penalty before appealing is a familiar feature of some Indian tax and regulatory appeals, and it is worth stating plainly that it does not appear here. Checked on 24 August 2026 against the Gazette text of the Act and the English section of the DPDP Rules 2025 as corrected, the word deposit appears in neither text. Section 29 states 1 monetary requirement, the prescribed fee, and Rule 22 states 3 sub rules and no more, none of them a deposit, security or part payment. That is an absence claim scoped to those 2 texts on that date; it says nothing about deposit requirements under the Telecom Regulatory Authority of India Act, 1997 or under the Tribunal's own practice.

How the Tribunal proceeds, and the 6 months. Section 29(8) leaves the Tribunal's procedure to be prescribed, without prejudice to sections 14A and 16 of the Telecom Regulatory Authority of India Act, 1997, and clause (y) of section 40(2) carries that power. Rule 22(3)(a) answers it: the Tribunal "shall not be bound by the procedure laid down by the Code of Civil Procedure, 1908 (5 of 1908), but shall be guided by the principles of natural justice and, subject to the provisions of the Act, may regulate its own procedure". Rule 22(3)(b) makes it a digital office in nearly the words of Rule 20, the 1 difference being that Rule 22(3)(b) carries the relative pronoun "which" after "digital office" where Rule 20 as printed has only a comma. The disposal language is an endeavour rather than a limitation:

"The appeal filed before the Appellate Tribunal under sub-section (1) shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date on which the appeal is presented to it."

Section 29(6) of the DPDP Act 2023, Gazette page 16.

The 6 months run from presentation. Section 29(7) supplies the consequence of missing it, and it is a recording duty, not a loss of jurisdiction: where the appeal could not be disposed of in that period, the Tribunal "shall record its reasons in writing" for not doing so. Section 29(5) requires a copy of every order to go to the Board and to the parties, and section 29(9) routes any further appeal against a Tribunal order to section 18 of the Telecom Regulatory Authority of India Act, 1997, whose content this site does not restate.

Getting the money: what section 34 says, and what the Act does not

Section 34 is 1 sentence, and it answers a narrower question than it is usually read to answer:

"All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India."

Section 34 of the DPDP Act 2023, Gazette page 17.

That is a destination provision. It says where money that has been realised goes, and it is the reason a DPDP penalty is not compensation to the individuals affected, a point developed in the penalties guide and taken to its conclusion in can I sue under the DPDP Act. It says nothing about how a penalty is collected from a person who does not pay it.

Nor does anything else, on the texts checked. Verified on 24 August 2026 against the Gazette text of the Act: the words recover, recovery and arrears appear nowhere in it. There is no provision that makes a Board order executable as a decree, no certificate procedure, and no clause treating an unpaid penalty as an arrear of land revenue. Section 30 is the only execution provision in the Act, and it is confined by its own words to "an order passed by the Appellate Tribunal". The asymmetry is the finding: the Tribunal's order comes with a decree route and the Board's order does not. The nearest thing the Act carries to a consequence for a penalised person is section 37, under which the Central Government may direct the blocking of public access to information on a Board reference that intimates "the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances". That is triggered by repeated imposition rather than by non payment, and it collects nothing.

3 cautions on how far that goes, because it is a gap in the text and not a conclusion about the law. Section 38(1) provides that the Act is in addition to and not in derogation of any other law in force, so other law is left standing and may supply a route. Section 40(1) is a general power to make rules not inconsistent with the Act to carry out its purposes, and the clauses of section 40(2) are expressly illustrative, so nothing here says a recovery rule could not be made. And section 39, which is already in force, bars a civil court only from entertaining a suit or proceeding "in respect of any matter for which the Board is empowered under the provisions of this Act". This site takes no position on what other law would supply the collection route. What it does say is that if you are looking for that machinery inside the DPDP Act or the 2025 Rules, it is not there as of 24 August 2026.

The timing picture

The institution and its powers commence separately. The Board itself was established on 13 November 2025 by notification G.S.R. 844(E), and the establishment sections, 18 to 26, are in force. The enforcement pipeline, section 27 except clause (1)(d), and sections 28 to 34, sits in the group due 18 months from the notification gazette, computed as 13 May 2027; section 27(1)(d), on Consent Manager registration breaches, arrives with the 1 year group, computed as 13 November 2026. Both computed dates are interpretation until officially confirmed. For organisations, the sequence work is the same either way: the obligations whose breach feeds this pipeline commence on the same computed dates, and the company action plan tool orders that work. For individuals, the rights assistant explains the grievance channel that must be exhausted before the Board is approached.

The split runs straight through the middle of this article, and it does not follow the Act and Rules boundary, which is what makes it easy to get wrong. It also has a second half that this article takes for granted: the Board has no appointed members either, and those 2 gaps are independent, so whether the Board is operational at all is a different question from how it will work once it is.

Both calendar dates are computed from the publication date printed on the gazettes and are this site's interpretation until officially confirmed. The official instruments state periods, 1 year and 18 months from publication, and not calendar dates. The consequence for reading this article: everything about how the Board must run an inquiry, size a penalty and be appealed against is drafted law that has not commenced, and should be read in the future tense, while the Board itself, the Chairperson's powers under section 26, the meeting procedure and inquiry period in Rule 19, the digital office duty in Rule 20 and the civil court bar in section 39 are law today.

1 source hygiene note, because it affects every Rules quotation above. Corrigenda G.S.R. 892(E) of 10 December 2025 correct pages 24, 29, 32, 34 and 38 of the Rules gazette and no others. Of the pages this article relies on, 2 are touched. On page 24, at lines 22 and 24, "of this Gazette" becomes "in the Official Gazette" in Rule 1(3) and Rule 1(4) without changing the periods they fix. On page 29, at line 44, "Department" becomes "Departments", a correction to Rule 13(5) that leaves Rule 13(2) and the opening of Rule 14 as published. Pages 30 and 31, which carry Rule 14(3) and the whole of Rules 19, 20, 21 and 22, are not corrected, so those texts are the texts as published.

Also worth watching: the Board's own design is before the Supreme Court. The appointment machinery in Rule 17 and the penalty power in section 33(1) are among the provisions under constitutional challenge, with no stay granted, so nothing above has been struck down or suspended and the commencement picture is unchanged. The case, hearing by hearing, is tracked in the Supreme Court challenge to the DPDP Act.