Section 28: Procedure to be followed by Board

Section 28 sets out how the Data Protection Board of India (the Board) must operate when handling complaints and inquiries. The Board must act as an independent body and operate as a digital office as much as possible. This means receiving complaints, holding hearings, and issuing decisions digitally by design, using techno-legal measures that may be prescribed by rules.

When the Board receives a complaint or a direction to investigate, it first decides if there are sufficient grounds to proceed. If the grounds are insufficient, the Board will record its reasons in writing and close the case. If there are sufficient grounds, the Board will launch an inquiry to check if a person is complying with the Act. The Board must follow the principles of natural justice and record the reasons for its actions during the inquiry.

To conduct its inquiries, the Board has the same powers as a civil court. It can summon people, examine them on oath, demand documents, and inspect data or records. The Board can also require police or government officers to assist it, and those officers must comply. However, the Board and its officers are not allowed to block access to a person's premises or seize equipment if doing so would disrupt that person's day-to-day functioning.

During an inquiry, the Board can issue interim orders, provided it gives the concerned person a chance to be heard. Once the inquiry is complete, the Board will either close the proceedings or take further action, again giving the person an opportunity to be heard. Finally, if the Board finds that a complaint is false or frivolous at any stage, it can issue a warning or impose costs on the person who made the complaint.

Key points

• The Board must function as an independent, digital-by-design office for handling complaints and hearings (1).
• The Board first determines if there are sufficient grounds for an inquiry, and can close proceedings if grounds are insufficient (3, 4).
• The Board has civil court powers to summon individuals, examine them on oath, and inspect data or documents (7).
• The Board cannot seize equipment or block access to premises if it would adversely affect a person's day-to-day functioning (8).
• The Board can issue interim orders during an inquiry and must give the concerned person an opportunity to be heard (10, 11).
• The Board can issue a warning or impose costs on a complainant if it decides a complaint is false or frivolous (12).

Common misreadings

• People might think the Board can shut down a business's operations during an investigation, but the Act specifically prevents the Board from seizing equipment or blocking premises in a way that disrupts day-to-day functioning.
• Complainants might assume there is no penalty for filing fake complaints, but the Board can impose costs or issue warnings for false or frivolous complaints.