Section 27 — Powers and functions of Board

What this section requires

The Board can act on: a breach-notification received under Section 8(6), directing urgent remedial measures and inquiring into the breach; a Data Principal's complaint about a breach or about a Data Fiduciary's failure to observe its obligations or honour her rights, a Central or State Government reference, or a court direction; a Data Principal's complaint against a Consent Manager; an intimation that a Consent Manager has breached its registration conditions; or a Central Government reference about an intermediary breaching Section 37(2). In every case it can inquire and impose a Section 33 penalty.

For effective discharge of its functions, the Board can — after a hearing and recorded reasons — issue binding directions, and can later modify, suspend, withdraw or cancel a direction on representation from an affected person or a government reference.

Who it applies to

Any Data Fiduciary, Data Processor, Consent Manager, or intermediary that becomes the subject of a Board inquiry, direction, or complaint — this section is what puts the Board's enforcement machinery into motion.

Checklist

• If you receive a Board direction, comply — Section 27(2) makes compliance mandatory once issued after a hearing.
• If a direction affects you and you believe it should be modified, suspended, withdrawn or cancelled, you can make a representation to the Board under Section 27(3) rather than simply ignoring it.
• Treat a breach notification under Section 8(6) as the trigger that can bring the Board's inquiry powers into play — it is the most common route into a Section 27 proceeding.

Penalty exposure

Section 27 is the gateway to a penalty, not itself a penalised obligation — the actual monetary penalty, once the Board concludes an inquiry, is fixed under Section 33 and the Schedule, based on which underlying provision was breached.

Implementation timeline

Clause (d) of sub-section (1) — the Board's power to act on a Central Government reference about an intermediary breaching Section 37(2) — commences 13 November 2026, tied to the same one-year clock as Section 6(9).

The rest of Section 27 commences 13 May 2027, with the rest of Chapter VI.