Section 28 — Procedure to be followed by Board

What this section requires

The Board functions as an independent, as-far-as-practicable digital body: complaint receipt, allocation, hearing and decisions are digital by design, using prescribed techno-legal measures. On a complaint or reference, it first decides whether there are sufficient grounds to proceed; if not, it can close the matter with recorded reasons; if so, it inquires following natural justice, with the same powers as a civil court to summon witnesses, take evidence, and inspect documents.

The Board (or its officers) cannot block access to premises or seize equipment in a way that would disrupt day-to-day operations, and can call on police or government officers for assistance. It can issue interim orders during an inquiry, and on completion, either closes the proceeding or moves to a Section 33 penalty. It can also warn or impose costs on a complainant it finds to have made a false or frivolous complaint.

Who it applies to

Any Data Fiduciary, Data Processor, or other person under Board inquiry — this section sets the procedure that inquiry follows, and the protections (natural justice, no operational disruption, a hearing before interim or final orders) that apply to the party being investigated.

Checklist

• Expect any Board inquiry to follow natural justice — a right to be heard before an interim or final order, not just at the end.
• The Board's civil-court-equivalent powers mean a summons, evidence request, or document inspection has real legal force — treat it accordingly.
• The Board cannot lawfully block your premises or seize equipment in a way that disrupts ongoing operations — that limit runs in the subject's favour.
• If you believe a complaint against you is false or frivolous, that is something the Board itself can act on under sub-section (12) — it isn't only a defence you raise informally.

Penalty exposure

Section 28 sets the Board's inquiry procedure; the actual monetary exposure from whatever the inquiry finds is fixed under Section 33 and the Schedule.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).