Enforcement: the Board, penalties and appeals

Lesson 1

The Data Protection Board of India

Chapter V of the Act, Sections 18 to 26, creates the regulator that enforces it: the Data Protection Board of India. Section 18 establishes the Board as a body corporate from a date the Central Government notifies. That gives it perpetual succession and a common seal, and lets it hold property and sue or be sued in its own name. Its headquarters are wherever the Central Government notifies.

Section 19 sets the Board's composition. It has a Chairperson and as many other Members as the Central Government notifies, all appointed by the Central Government in the manner prescribed under the DPDP Rules, 2025 (Rule 17 deals with this). Each appointee must be a person of ability, integrity and standing, with special knowledge or practical experience in a relevant field: data governance, law relating to social or consumer protection, dispute resolution, information and communication technology, the digital economy, regulation or techno-regulation. At least one Member must be an expert in law.

Section 20 covers terms of service. Salary, allowances and other conditions of service are as prescribed (Rule 18), and they cannot be varied to a Member's disadvantage after appointment. The Chairperson and each Member hold office for two years and are eligible for reappointment. Section 21 lists the grounds that disqualify a person from being appointed or from continuing in office. These are being adjudged insolvent, being convicted of an offence the Central Government considers to involve moral turpitude, becoming physically or mentally incapable, acquiring a financial or other interest likely to prejudice her functions, and abusing her position so that continuing would harm the public interest. Nobody can be removed without first being given an opportunity to be heard.

Several provisions protect the Board's independence and integrity. Service conditions cannot be worsened mid-term, and a conflicting interest is a ground for disqualification. Under Section 22, a Member may resign by written notice to the Central Government. The resignation takes effect on the earliest of the government permitting it, three months from the notice, a successor taking office, or the end of the term. For one year after leaving office, a former Chairperson or Member needs the Central Government's approval before taking up employment, and must disclose any later employment with a Data Fiduciary against whom she handled proceedings. Section 25 deems the Chairperson, Members, officers and employees to be public servants under Section 21 of the Indian Penal Code while acting under the Act, so bribing or obstructing them becomes a public-servant offence under that code.

The remaining sections deal with how the Board runs itself. Under Section 23, the Board follows a prescribed procedure for its meetings, which may be held by digital means (Rule 19). No act or proceeding is invalid merely because of a vacancy, a defect in the Board's constitution or in someone's appointment, or an irregularity that does not affect the merits. If the Chairperson cannot act because of absence, illness or another cause, the senior-most Member acts in her place. Under Section 24, the Board may appoint officers and employees with the Central Government's prior approval (Rule 21). Under Section 26, the Chairperson has general superintendence over administrative matters, can authorise an officer to scrutinise correspondence addressed to the Board, and can allocate the Board's functions and proceedings among Members.

Sections 18 to 26 have been in force since 13 November 2025. The Board therefore exists in law today, but most of its enforcement powers in Sections 27 and 28 do not commence until 13 May 2027. None of these Chapter V provisions places a compliance duty on a Data Fiduciary. They create and govern the institution that will later hold Data Fiduciaries to account.

• The Board is a body corporate that can sue and be sued in its own name, with its headquarters wherever the Central Government notifies.
• The Central Government appoints the Chairperson and Members. Each serves a two-year term and can be reappointed, and at least one Member must be a legal expert.
• Service conditions cannot be varied to a Member's disadvantage after appointment, and a former Member needs Central Government approval before taking employment within one year of leaving office.
• Board Members, officers and employees are public servants under Section 21 of the Indian Penal Code while acting under the Act.
• Sections 18 to 26 have been in force since 13 November 2025, but most of the Board's enforcement powers commence on 13 May 2027.

Section 18Section 19Section 20Section 21Section 22Section 23Section 24Section 25Section 26

Lesson 2

How the Board acts: triggers, inquiries and directions

Section 27 sets out when the Board can act. It can act on a personal data breach intimated to it by a Data Fiduciary under Section 8(6), and may then direct urgent remedial measures and inquire into the breach. It can act on a complaint from a Data Principal about a breach or about a Data Fiduciary's failure to meet its obligations or honour her rights, on a reference from the Central or a State Government, or on a court's direction. It can act on a Data Principal's complaint against a Consent Manager, or on an intimation that a Consent Manager has breached the conditions of its registration. Finally, it can act on a Central Government reference about an intermediary breaching Section 37(2). In each case the Board can inquire and, where justified, impose a penalty under Section 33.

A Data Principal does not go straight to the Board. Under Section 13, she must first use the grievance redressal channel of the Data Fiduciary or Consent Manager concerned before she can escalate to the Board. To carry out its functions, the Board can also issue binding directions under Section 27(2), but only after giving the persons concerned a hearing and recording its reasons in writing. On a representation from an affected person, or on a reference from the Central Government, the Board can later modify, suspend, withdraw or cancel a direction.

Section 28 describes how the Board works. It functions as an independent body and, as far as practicable, as a digital office. Receiving complaints, allocating them, hearing them and pronouncing decisions are all meant to happen digitally, using techno-legal measures that may be prescribed. In practice, a party dealing with the Board should expect an online process rather than paper filings and in-person hearings.

On receiving a complaint, intimation or reference, the Board first decides whether there are sufficient grounds to proceed. If there are not, it can close the matter, recording its reasons. If there are, it inquires into the matter following the principles of natural justice. For this purpose it has the same powers as a civil court to summon witnesses, take evidence and inspect documents. It can issue interim orders during an inquiry, after giving the person concerned a hearing. When the inquiry ends, it either closes the proceeding or moves to a penalty under Section 33.

The Act also limits the Board's powers. Neither the Board nor its officers may prevent access to premises or take equipment into custody in a way that would disrupt the day-to-day functioning of the person under inquiry. The Board can, however, call on police or other government officers for help. Complainants do not escape scrutiny either: if the Board finds a complaint false or frivolous, it can issue a warning or impose costs on the complainant.

These powers come into force in stages. Clause (d) of Section 27(1), the Board's power to act on a Central Government reference about an intermediary, commences on 13 November 2026. The rest of Section 27, and all of Section 28, commence on 13 May 2027. Until then the Board exists in law but cannot run these inquiries.

• The Board can act on a breach intimation, a Data Principal's complaint, a Central or State Government reference, a court direction, matters involving Consent Managers, and a reference about an intermediary.
• A Data Principal must use the Data Fiduciary's own grievance channel under Section 13 before complaining to the Board.
• The Board works as a digital office and, in an inquiry, has a civil court's powers to summon witnesses, take evidence and inspect documents.
• The Board cannot block premises or seize equipment in a way that disrupts day-to-day operations, and it can warn or impose costs on a person who makes a false or frivolous complaint.
• Section 27(1)(d) commences on 13 November 2026. The rest of Section 27 and all of Section 28 commence on 13 May 2027.

Section 27Section 28Section 8Section 13

Lesson 3

Appeals to the Appellate Tribunal

Any person aggrieved by an order or direction of the Board can appeal under Section 29 to the Appellate Tribunal. For this Act, the Appellate Tribunal is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The right is open to anyone the order affects, whether a Data Fiduciary, a Data Processor, a Consent Manager or a Data Principal, and it is the only route the Act provides for challenging the Board.

The appeal must be filed within 60 days of receiving the order or direction, so the clock runs from receipt and not from the date written on the order. It must be in the form and manner, and with the fee, that the DPDP Rules, 2025 prescribe (Rule 22 covers appeals). The Tribunal can admit an appeal filed after the 60 days if it is satisfied that there was sufficient cause for the delay. This is a discretion, not an entitlement.

After giving the parties an opportunity to be heard, the Tribunal can confirm, modify or set aside the Board's order, and it sends a copy of its own order to the Board and to the parties. It aims to dispose of an appeal within six months, and if it does not, it must record its reasons in writing. Like the Board, the Tribunal is to function as a digital office for these appeals as far as practicable.

Under Section 30, a Tribunal order can be executed as a decree of a civil court, and the Tribunal has a civil court's powers for that purpose. It may instead send the order to a civil court with local jurisdiction, which then executes it as if it were that court's own decree.

The appeal route matters because other routes are closed. Section 39 bars civil courts from hearing any matter the Board is empowered to deal with, and no court or authority may grant an injunction against action taken, or intended, under the Act. Section 44(1), in force since 13 November 2025, adds the Appellate Tribunal under this Act to the list in Section 14(c) of the Telecom Regulatory Authority of India Act, 1997, which is how TDSAT formally takes on this role. Sections 29 and 30 commence on 13 May 2027, together with the Board's inquiry powers.

• Appeals against Board orders and directions go to the Appellate Tribunal, which is TDSAT.
• An appeal must be filed within 60 days of receiving the order, and the Tribunal may admit a late appeal if there was sufficient cause for the delay.
• The Tribunal can confirm, modify or set aside the order, and it aims to decide appeals within six months.
• A Tribunal order is executable as a civil court decree.
• Civil courts cannot hear matters within the Board's remit or grant injunctions against action under the Act, so the Tribunal is the route for a challenge.

Section 29Section 30Section 39Section 44

Lesson 4

Mediation and voluntary undertakings

Not every complaint needs a full inquiry ending in a penalty. Chapter VII of the Act gives the Board two ways to resolve a matter more quickly: directing the parties to mediation, and accepting a voluntary undertaking from the person whose conduct is in question.

Under Section 31, if the Board is of the opinion that a complaint may be resolved by mediation, it can direct the parties to attempt it. The mediator can be one the parties agree on, or one provided for under any applicable law. Declining mediation is not itself penalised. But mediation can settle a dispute faster and more cheaply than an inquiry, so an organisation that refuses it gives up that chance.

Under Section 32, the Board can accept a voluntary undertaking at any stage of a proceeding under Section 28. An undertaking is a commitment to take a specified action, or to refrain from one, within a set time. It may include a commitment to make the undertaking public. The Board can later vary its terms, but only with the consent of the person who gave it.

Once the Board accepts an undertaking, no further proceedings can be taken on the matters it covers, which is what makes it attractive. The protection lasts only while the undertaking is kept. If the person breaches any of its terms, the breach is treated as a breach of the Act itself, and the Board can impose a penalty under Section 33 after a hearing. Item 6 of the Schedule sets the ceiling for that penalty at the amount that applied to the original breach for which the Section 28 proceeding began.

Sections 31 and 32, like the inquiry procedure they connect to, commence on 13 May 2027. For an organisation, the practical lesson is to treat an accepted undertaking as a binding obligation. If circumstances change, it should ask the Board to vary the terms rather than simply depart from them.

• The Board can direct the parties to attempt mediation through a mutually agreed mediator or one provided for under any applicable law.
• A voluntary undertaking can be accepted at any stage of a Section 28 proceeding, and its terms can be varied only with the consent of the person who gave it.
• An accepted undertaking bars further proceedings on the matters it covers.
• Breaching an undertaking is treated as a breach of the Act and can draw a penalty up to the amount applicable to the original breach.
• Sections 31 and 32 commence on 13 May 2027.

Section 31Section 32Section 28Section 33

Lesson 5

Penalties: Section 33 and the Schedule

Section 33 is where an inquiry turns into money. If the Board concludes, at the end of an inquiry, that a breach of the Act or the Rules by a person is significant, it can impose the monetary penalty the Schedule specifies for that breach, after giving the person an opportunity to be heard. The Act's penalties are monetary and imposed by the Board. The Act creates no criminal offence and no imprisonment of its own.

The Schedule has seven items, each with a maximum amount. Failing to take reasonable security safeguards to prevent a personal data breach, under Section 8(5), carries up to ₹250 crore, the highest figure in the Act. Failing to notify the Board or affected Data Principals of a breach, under Section 8(6), carries up to ₹200 crore. Breaching the additional obligations for children's data under Section 9 carries up to ₹200 crore. Breaching the additional obligations of a Significant Data Fiduciary under Section 10 carries up to ₹150 crore. A Data Principal who breaches her duties under Section 15 faces up to ₹10,000. Breaching a voluntary undertaking accepted under Section 32 carries a penalty up to the amount that applied to the original breach. Breaching any other provision of the Act or the Rules carries up to ₹50 crore.

The last item works as a catch-all. Many obligations have no Schedule item of their own: notice, consent, processor contracts, accuracy, erasure, the access and correction rights, grievance redressal, and a failure to furnish information the Central Government calls for. A breach of any of these falls under that residual item, with its ceiling of ₹50 crore. The ₹10,000 item is the only one that penalises the individual rather than an organisation.

Each figure is a ceiling, not a fixed fine. In deciding the amount, Section 33 requires the Board to weigh the nature, gravity and duration of the breach; the type and sensitivity of the personal data affected; whether the breach was repeated; whether the person gained something or avoided a loss as a result; whether the person took action to mitigate the breach, and how quickly and effectively; whether the penalty is proportionate and would deter future breaches; and the likely impact of the penalty on the person. Because the Board must consider mitigation, records of the steps taken after a breach matter.

Under Section 34, every sum the Board realises as penalties is credited to the Consolidated Fund of India. Under Section 42, the Central Government can amend the Schedule by notification, but it can never raise a penalty to more than twice the amount the Act originally specified. Section 42 has been in force since 13 November 2025. Sections 33 and 34 commence on 13 May 2027, together with the obligations whose breach they penalise.

• The Board can impose a Schedule penalty only after an inquiry, a finding that the breach is significant, and a hearing.
• Maximums: ₹250 crore for security safeguards, ₹200 crore for breach notification, ₹200 crore for children's data, ₹150 crore for Significant Data Fiduciary duties, and ₹10,000 for a Data Principal's duties.
• Breaching any other provision carries up to ₹50 crore, and breaching a voluntary undertaking carries up to the amount for the original breach.
• The Board must weigh statutory factors, including gravity, duration, repetition, gain, mitigation, proportionality and the penalty's impact, when it sets an amount below the ceiling.
• Penalties go to the Consolidated Fund of India, and the government can raise Schedule amounts by notification, but never beyond double the original figures.

Section 33Section 34Section 42Section 8Section 9Section 10Section 15Section 32

Lesson 6

Government powers and the Act's place among other laws

Chapter IX, Sections 35 to 44, collects provisions that sit around the enforcement machinery. Section 35 protects those who administer the Act: no suit, prosecution or other legal proceeding lies against the Central Government, the Board, or its Chairperson, Members, officers or employees for anything done, or intended to be done, in good faith under the Act or the Rules. It has been in force since 13 November 2025.

Two Central Government powers matter directly to organisations. Under Section 36, the government can require the Board, any Data Fiduciary or any intermediary to furnish information it calls for, for the purposes of the Act. Under Section 37, the government can order public access to a platform to be blocked, as a last resort. This needs a written reference from the Board stating that it has imposed a monetary penalty on the Data Fiduciary in two or more instances and advising that blocking is in the public interest. The government, or an officer it authorises, must then give the Data Fiduciary an opportunity to be heard and record its reasons. Only after that can it direct a government agency or an intermediary to block public access to information on a computer resource the Data Fiduciary uses to offer goods or services to Data Principals in India. An intermediary that receives such a direction must comply. Sections 36 and 37 commence on 13 May 2027.

Section 38 sets out the Act's relationship with other laws. The Act is in addition to, and not in derogation of, any other law in force. Where it conflicts with another law, the Act prevails to the extent of that conflict. Sectoral rules such as data localisation requirements therefore continue to apply alongside it wherever there is no real clash. Section 39 bars civil courts from hearing any matter the Board is empowered to determine, and no court or authority can grant an injunction against action taken or intended under the Act. Both sections have been in force since 13 November 2025.

Section 40 gives the Central Government power to make rules, subject to prior publication and consistent with the Act, on the matters it lists. The DPDP Rules, 2025, published on 13 November 2025, are that power in use. Under Section 41, every rule, and every notification under Section 16 or Section 42, must be laid before both Houses of Parliament for a total of 30 days, and Parliament can modify or annul it. Under Section 43, the government can make orders to remove difficulties in giving effect to the Act, but not after three years from its commencement.

Section 44 amends three other Acts. Section 44(1) adds the Appellate Tribunal under this Act to Section 14(c) of the Telecom Regulatory Authority of India Act, 1997. Section 44(2) amends the Information Technology Act, 2000. It omits Section 43A, the old compensation provision for data breaches, inserts a reference to this Act in the proviso to Section 81, and omits clause (ob) of Section 87(2). Section 44(3) substitutes Section 8(1)(j) of the Right to Information Act, 2005, which narrows what personal information a public authority must disclose. Sub-sections (1) and (3) have been in force since 13 November 2025. Sub-section (2), the IT Act amendments, commences on 13 May 2027, when the DPDP breach and penalty regime takes over from Section 43A.

• Section 35 protects the Central Government and the Board from legal proceedings for action taken in good faith.
• The Central Government can call for information from the Board, a Data Fiduciary or an intermediary under Section 36.
• Blocking under Section 37 requires a Board reference after two or more penalties, a hearing and recorded reasons, and intermediaries must comply with a blocking direction.
• The Act adds to other laws and prevails only to the extent of a conflict, and civil courts cannot hear matters within the Board's remit.
• Section 44 omits Section 43A of the IT Act from 13 May 2027, and has amended the RTI Act's personal-information exemption since 13 November 2025.

Section 35Section 36Section 37Section 38Section 39Section 40Section 41Section 43Section 44