s.18 · s.27 · s.28 · Rule 19 · s.29
Data Protection Board of India
The Data Protection Board of India is the body established under Section 18 that receives breach intimations and complaints, inquires into them, directs remedial measures and imposes the penalties in the Schedule.
The Board is a digital office by design: complaints, hearings and orders run through a digital platform. Its inquiry powers are those of a civil court, and Rule 19 requires an inquiry to be completed within six months, extendable in three-month steps for reasons recorded in writing.
A Data Principal must exhaust the Data Fiduciary’s own grievance mechanism before approaching the Board, under Section 13(3). Appeals from the Board go to the Appellate Tribunal, which is the TDSAT, within sixty days.
Questions people ask
- Can the Board fine us directly?
- Yes. Section 33 empowers the Board to impose the monetary penalties in the Schedule after an inquiry, where it finds a significant breach.
- Where do penalties go?
- To the Consolidated Fund of India, under Section 34. The Data Principal does not receive compensation from a penalty.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.