Gevox
Start a scan
DPDP reference

Section 27

Powers and functions of the Board

Sets out what the Board actually does: acts on breach intimations and complaints, inquires, directs remedial measures and imposes penalties.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1)(a)
On receiving intimation of a personal data breach under s.8(6), the Board may direct urgent remedial or mitigation measures, inquire into the breach, and impose a penalty.
(1)(b)
On a complaint by a Data Principal about a breach, or about a Data Fiduciary failing to observe its obligations, the Board may inquire and impose a penalty.
(1)(c)
The Board may inquire into a Consent Manager’s breach of its obligations.
(1)(d)–(e)
The Board may inquire into registration and intermediary breaches.
(2)–(3)
The Board may issue directions that bind the person they are issued to, and may modify, suspend, withdraw or cancel them.

In practice

Clause (1)(a) is the part worth planning around. A breach intimation filed under s.8(6) is itself the trigger for an inquiry, so the notification and the investigation are not separate events. Rule 19 gives the Board six months to complete that inquiry, extendable in three-month steps for recorded reasons.

Read next

s.8General obligations of Data FiduciaryThe operational core of the Act: accountability for processors, accuracy, security safeguards, breach intimation, erasure, published contact details and grievance redressal.s.28Procedure to be followed by the BoardMakes the Board a digital-by-design office with civil court powers, natural justice obligations and the ability to award costs against frivolous complaints.s.33PenaltiesEmpowers the Board to impose the monetary penalties in The Schedule where a breach is significant, and lists the factors that set the amount.Rule 19Meetings of the Board and the six-month inquiry windowGoverns Board meetings and quorum, and requires an inquiry to be completed within six months, extendable in three-month steps.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 27 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy