/Guides · Businesses
Penalties, enforcement and how the Data Protection Board works
How the Data Protection Board of India inquires into breaches, what penalties the Schedule sets, and how appeals to the Appellate Tribunal work.
Enforcement runs through one body. The Data Protection Board of India inquires, directs and imposes monetary penalties, and appeals go to the Appellate Tribunal. This guide covers its composition, how an inquiry runs, the penalty amounts in the Schedule, and the routes out of a proceeding.
The Board, and when it came into existence#
Section 18 lets the Central Government establish the Board by notification as a body corporate that can hold property, contract, sue and be sued. That happened on 13 November 2025 through G.S.R. 844(E), with its head office in the National Capital Region of India. The same day, G.S.R. 845(E) notified under section 19(1) that "the Data Protection Board of India shall consist of four members".
Members are appointed by the Central Government and must be persons of ability, integrity and standing with special knowledge or experience in fields such as data governance, dispute resolution, information technology or law, at least one an expert in law (section 19). The term is two years, with eligibility for re-appointment (section 20(2)).
Rule 17 builds the selection machinery: a Search-cum-Selection Committee chaired by the Cabinet Secretary recommends the Chairperson, and one chaired by the Secretary of the Ministry of Electronics and Information Technology recommends other Members. Salaries follow the Fifth Schedule (rule 18) and staff terms the Sixth Schedule (rule 21). Members and officers are deemed public servants when acting under the Act (section 25). Appointments are tracked on the Board page.
What the Board can act on#
Section 27(1) lists five triggers. The Board acts on an intimation of a personal data breach under section 8(6), where it may also direct urgent remedial or mitigation measures. It acts on a Data Principal's complaint about a breach or about a Data Fiduciary's observance of its obligations or her rights, and on a government reference or a court's directions. It acts on a complaint against a Consent Manager, on an intimation that one has breached a registration condition, and on a reference about an intermediary ignoring a blocking direction (section 37(2)).
Beyond penalties, the Board may issue directions to any person after a hearing and with reasons recorded, and that person is bound to comply (section 27(2)). It may modify, suspend, withdraw or cancel a direction on a representation from someone affected (section 27(3)).
How an inquiry runs#
The Board "shall function as an independent body and shall, as far as practicable, function as a digital office", with complaints, allocation, hearings and decisions "being digital by design" (section 28(1)). Rule 20 puts that operationally: the Board works as a digital office and may adopt techno-legal measures so proceedings need no physical presence.
The Board first decides whether there are sufficient grounds to proceed, closing the matter with written reasons if there are not (section 28(3), section 28(4)). If there are, it may inquire into any person's affairs to check compliance (section 28(5)), following natural justice and recording reasons as it goes (section 28(6)).
For that inquiry the Board holds civil-court powers under the Code of Civil Procedure, 1908: summoning and examining people on oath, evidence on affidavit, discovery and production of documents, and inspection of data, books, registers and accounts (section 28(7)). Two limits follow. The Board and its officers "shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person" (section 28(8)), and interim orders need reasons and a hearing (section 28(10)).
At the end, after another hearing and with reasons recorded, the Board either closes the proceedings or moves to penalties (section 28(11)). A false or frivolous complaint can draw a warning or costs (section 28(12)).
There is a clock. Under rule 19(9) the inquiry "shall be completed within a period of six months" from receipt of the intimation, complaint, reference or direction, extendable for written reasons "for a further period not exceeding three months at a time". The same rule sets the quorum at one-third of the membership, with questions decided by majority and a casting vote for the chair.
Penalties#
A penalty follows only where the Board "determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant", and only after a hearing (section 33(1)). The amount comes from the Schedule, and section 33(2) lists seven matters the Board must weigh: the nature, gravity and duration of the breach; the type of personal data affected; whether it is repetitive; whether the person gained or avoided a loss; the mitigating action taken and how timely and effective it was; proportionality against the need to deter; and the likely impact of the penalty on the person.
| Sl. No. | Breach of provisions of this Act or rules made thereunder | Penalty |
|---|---|---|
| 1 | Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. | May extend to two hundred and fifty crore rupees. |
| 2 | Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. | May extend to two hundred crore rupees. |
| 3 | Breach in observance of additional obligations in relation to children under section 9. | May extend to two hundred crore rupees. |
| 4 | Breach in observance of additional obligations of Significant Data Fiduciary under section 10. | May extend to one hundred and fifty crore rupees. |
| 5 | Breach in observance of the duties under section 15. | May extend to ten thousand rupees. |
| 6 | Breach of any term of voluntary undertaking accepted by the Board under section 32. | Up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted. |
| 7 | Breach of any other provision of this Act or the rules made thereunder. | May extend to fifty crore rupees. |
Every rupee collected goes to the Consolidated Fund of India (section 34).
Two ways out of a proceeding#
The Board may accept a voluntary undertaking from any person at any stage of a proceeding under section 28 (section 32(1)). It may commit that person to act or refrain from acting within a set time, and to publicise the undertaking (section 32(2)). Acceptance bars proceedings on what it covers (section 32(4)). Break a term and that is deemed a breach of the Act, sending the matter back to section 33 after a hearing (section 32(5)).
The second route is mediation. If the Board thinks a complaint may be resolved that way, it may direct the parties to try, through a mediator they agree on or as provided under any law (section 31).
Appeals#
An appeal against a Board order or direction goes to the Appellate Tribunal, which the Act defines as the Telecom Disputes Settlement and Appellate Tribunal (section 2(a), section 29(1)). It must be filed "within a period of sixty days from the date of receipt of the order or direction appealed against" (section 29(2)), though a late appeal can be admitted for sufficient cause (section 29(3)). The Tribunal hears the parties and may confirm, modify or set aside the order (section 29(4)), and is to endeavour to dispose of it within six months, recording written reasons if it cannot (section 29(6), section 29(7)). It too works as a digital office as far as practicable (section 29(10)).
Rule 22 adds the detail. The appeal is filed in digital form, the fee matches that for an appeal under the Telecom Regulatory Authority of India Act, 1997 unless the Tribunal's Chairperson reduces or waives it, and it is paid through the Unified Payments Interface or another Reserve Bank of India authorised system.
A Tribunal order is executable by it as a decree of a civil court (section 30(1)), or it may send the order to a civil court with local jurisdiction to execute as its own decree (section 30(2)). Civil courts have no jurisdiction over matters the Board can decide (section 39).
What is in force#
G.S.R. 843(E) staged the commencement. Sections 18 to 26, which create and staff the Board, came into force on 13 November 2025, along with rules 1 and 2 and rules 17 to 21. Clause (d) of section 27(1) starts on 13 November 2026, in step with rule 4. The rest of section 27, and sections 28 to 34, 36 and 37, start on 13 May 2027, with rule 22 and rule 23. The Board exists now; the inquiry, penalty and appeal provisions are not yet live.
Key provisions#
- Section 18 to section 26: establishment and composition
- Section 27: powers and functions
- Section 28: procedure and civil-court powers
- Section 29, section 30: appeals and execution
- Section 31, section 32: mediation, voluntary undertaking
- Section 33, the Schedule: penalties and amounts
- Section 34: penalties to the Consolidated Fund
- Rules 17 to 21: appointments, salaries, meetings, staff
- Rule 22: appeal procedure and fee
- G.S.R. 844(E), G.S.R. 845(E): establishment, four members
/MYND · DPDP practice
Want help applying this?
MYND runs DPDP compliance programmes for the data that flows through HR, payroll, finance and vendor operations: readiness assessments, consent and notice design, processor contracts and breach playbooks. Tell us what you are working on and a compliance lead will reply within one working day.