Gevox
DPDP reference

Rule 19

Meetings of the Board and the six-month inquiry window

Governs Board meetings and quorum, and requires an inquiry to be completed within six months, extendable in three-month steps.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

01
Provides for the conduct of Board meetings, a quorum of one-third of the members, and a casting vote for the presiding member.
02
An inquiry on an intimation, complaint or reference under s.27 must be completed within six months, extendable by up to three months at a time for reasons recorded in writing.

In practice

The six-month window is the closest thing the Act gives a business to a horizon on exposure after a breach filing. It is extendable, but each extension has to be recorded, which is a fact worth knowing when an inquiry appears to have gone quiet.

Read next

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Rule 19 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy