Data Protection Board of India: powers, complaints and penalties

Chapter V of the DPDP Act, 2023 creates the Board:

• Establishment (s. 18). The Board is established with effect from a date the Central Government appoints by notification. It is a body corporate with perpetual succession and a common seal, and its headquarters are at a place the Central Government notifies.
• Independence and digital working (s. 28(1)). It functions as an independent body and, as far as practicable, as a digital office, with complaints received, allocated, heard and decided digitally.
• Public servants (s. 25). The Chairperson, Members, officers and employees are deemed public servants when acting under the Act.
• Bar on civil courts (s. 39). No civil court can entertain a suit on a matter the Board is empowered to deal with.

The PIB release of 14 November 2025 describes the Board as a fully digital institution where citizens will file and track complaints online through a dedicated platform and mobile app. For who currently sits on the Board and where it is headquartered, rely on the Central Government’s notifications rather than this page.

Which Board provisions are in force?

Source: the Act’s commencement notification, G.S.R. 843(E) (Gazette notification). In short, the Board’s structure is in force, but its complaint-handling and penalty powers apply from 13 May 2027, the same date as the duties of Data Fiduciaries.

Section 27(1) lists what the Board acts on. These powers, and the procedure in section 28, apply from 13 May 2027, except clause (d), which applies from 13 November 2026.

Beyond that list, the Board can:

• issue binding directions after a hearing, and modify, suspend, withdraw or cancel them (s. 27(2) and (3));
• exercise civil-court powers to summon and examine on oath, require documents and inspect any data, book or register (s. 28(7)), but without preventing access to premises or seizing equipment in a way that disrupts day-to-day functioning (s. 28(8));
• call on police and government officers for assistance (s. 28(9)) and pass interim orders after a hearing (s. 28(10));
• send a dispute to mediation (s. 31) or accept a voluntary undertaking, which bars proceedings on its contents unless breached (s. 32);
• warn or impose costs on a complainant whose complaint is false or frivolous (s. 28(12));
• register Consent Managers and suspend or cancel their registration (Rule 4); and, where a Data Fiduciary has been penalised in two or more instances, refer the case to the Central Government, which may order public access to its service to be blocked after a hearing (s. 37).

The complaint route below runs on sections 13 and 28, both in force from 13 May 2027.

1. Go to the Data Fiduciary first. The Data Principal raises a grievance with the Data Fiduciary or Consent Manager (s. 13(1)). It must respond within the period it publishes, not exceeding ninety days (Rule 14(3)). Section 13(3) requires the Data Principal to exhaust this before approaching the Board.
2. Complain to the Board. The Board decides whether there are sufficient grounds to inquire; if not, it closes the proceedings with recorded reasons (s. 28(3) and (4)).
3. Inquiry. The Board inquires following natural justice and records reasons (s. 28(5) and (6)), aiming to finish within six months, extendable by up to three months at a time (Rule 19(9)).
4. Outcome. After a hearing it either closes the proceedings or proceeds to a penalty under section 33 (s. 28(11)).

A Data Principal has duties too: section 15(d) forbids registering a false or frivolous grievance or complaint, and breach of section 15 duties can attract a penalty of up to ₹10,000.

Section 33 and the Schedule apply from 13 May 2027. Under section 33(1), if the Board finds on conclusion of an inquiry that a breach is significant, it may impose the monetary penalty specified in the Schedule after giving the person a hearing. The Schedule reads:

Section 33(2) sets what the Board weighs: the nature, gravity and duration of the breach; the type of personal data affected; repetition; any gain made or loss avoided; mitigation and how timely and effective it was; whether the penalty is proportionate and effective; and its likely impact on the person. Penalties go to the Consolidated Fund of India (s. 34). Section 42 allows the Central Government to amend the Schedule, but not to raise any penalty to more than twice the amount originally enacted.

The Appellate Tribunal under the Act is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), established under section 14 of the TRAI Act, 1997 (s. 2(a)). Sections 29 and 30 apply from 13 May 2027.

The Board’s inquiries turn on evidence: notices, consents, breach timelines and grievance responses. Planned features of the Perimattic DPDP Compliance Suite that build that evidence:

• A breach response workflow for intimations to affected Data Principals and reports to the Board under Rule 7.
• Data Principal rights requests and grievances with response-time tracking, so complaints are resolved before they reach the Board.
• Consent capture and records, so you can prove notice and consent as section 6(10) requires.
• A personal-data inventory and a processor and vendor register.

Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. It is not certified or approved by the Board or any government body, and using it will not by itself make a business compliant. Sign up to follow the build.

General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.