Data Protection Board of India: complaints, inquiry and appeals
- A Data Principal must use the Data Fiduciary's grievance process before complaining to the Board (s.13(3)).
- The Board screens for sufficient grounds, inquires with civil court powers, and must finish within six months, extendable by three months at a time (s.28, Rule 19(9)).
- Cases can end in closure, mediation (s.31), a voluntary undertaking (s.32), directions (s.27(2)) or a penalty (s.33).
- Appeals go to the Telecom Disputes Settlement and Appellate Tribunal within sixty days, filed digitally (s.2(a), s.29(2), Rule 22).
The Data Protection Board of India is the body that inquires into breaches of the DPDP Act and imposes penalties. This guide follows a complaint from the first grievance to a final appeal, with the section or rule behind each step.
What the Board is
The Board is established by the Central Government as a body corporate (s.18). It has a Chairperson and other Members (s.19(1)), at least one of whom must be an expert in law (s.19(3)). Members serve two-year terms and can be re-appointed (s.20(2)). Rules 17 to 21 cover appointments, service terms and meetings. Sections 18 to 26 and Rules 17 to 21 have applied since 13 November 2025 (commencement note under s.1(2); Rule 1(2)).
Step 1: grievance with the Data Fiduciary
A Data Principal has a right to readily available grievance redressal from the Data Fiduciary or Consent Manager (s.13(1)), and must exhaust it before approaching the Board (s.13(3)). The Data Fiduciary must publish a response period that does not exceed ninety days (Rule 14(3)). Every consent notice must already explain how to complain to the Board (s.5(1)(iii), Rule 3(c)(iii)). See grievance redressal under DPDP.
Step 2: what can start a Board case
- a Data Fiduciary's own breach intimation (s.27(1)(a));
- a Data Principal's complaint about a personal data breach, a breach of obligations, or her rights (s.27(1)(b));
- a reference from the Central or a State Government, or a court direction (s.27(1)(b));
- complaints or intimations about Consent Managers (s.27(1)(c) and (d));
- a Central Government reference about an intermediary not following a blocking direction (s.27(1)(e)).
On a breach intimation, the Board can also direct urgent remedial or mitigation measures (s.27(1)(a)).
Step 3: screening and inquiry
- Screening. The Board decides whether there are sufficient grounds (s.28(3)) and may close the case with written reasons if not (s.28(4)).
- Inquiry. If it proceeds, it records reasons and inquires into whether the person is complying or has complied with the Act (s.28(5)), following natural justice (s.28(6)).
- Powers. It has civil court powers to summon and examine on oath, receive affidavit evidence and inspect data, books and documents (s.28(7)). It may not block access to premises or take equipment in a way that adversely affects day-to-day functioning (s.28(8)). It can call on police or government officers for assistance (s.28(9)).
- Interim orders. Possible after a hearing, with written reasons (s.28(10)).
- Outcome. After a hearing, the Board closes the case or proceeds to a penalty under s.33 (s.28(11)).
The inquiry must be completed within six months of receiving the intimation, complaint, reference or direction. The Board may extend this by up to three months at a time, with written reasons (Rule 19(9)).
Step 4: possible outcomes
- Mediation. The Board may direct the parties to try mediation with an agreed mediator or one provided under law (s.31).
- Voluntary undertaking. Accepted at any stage, it bars proceedings on its contents (s.32(1) and (4)); breaking it is treated as a breach (s.32(5)).
- Directions. Binding directions issued after a hearing, with reasons (s.27(2)). An affected person can ask the Board to modify, suspend, withdraw or cancel them (s.27(3)).
- Penalty. Only if the breach is significant, after a hearing, within the Schedule ceilings and weighing the s.33(2) factors. See how DPDP penalties are decided.
The Act does not provide for the Board to award compensation to a complainant; penalties go to the Consolidated Fund of India (s.34). Complainants carry risk too: a complaint the Board finds false or frivolous can lead to a warning or costs (s.28(12)), and registering one breaches a Data Principal's duty under s.15(d). See duties of Data Principals.
Step 5: appeal to the Appellate Tribunal
The Appellate Tribunal is the Telecom Disputes Settlement and Appellate Tribunal established under the TRAI Act, 1997 (s.2(a)).
| Point | What the law says | Source |
|---|---|---|
| Who can appeal | Any person aggrieved by an order or direction of the Board | s.29(1), Rule 22(1) |
| Deadline | Sixty days from receiving the order; later only if the Tribunal accepts sufficient cause | s.29(2), s.29(3) |
| How to file | In digital form, as the Tribunal decides | Rule 22(1) |
| Fee | Same as for appeals under the TRAI Act, 1997, unless reduced or waived by the Tribunal's Chairperson; payable by UPI or another RBI-authorised system | Rule 22(2) |
| Procedure | Not bound by the Code of Civil Procedure; guided by natural justice; functions as a digital office | Rule 22(3), s.29(10) |
| Decision | Confirm, modify or set aside, after hearing the parties | s.29(4) |
| Timeline | Endeavour to dispose of within six months; reasons recorded if not | s.29(6), s.29(7) |
| Enforcement | Orders are executable as a civil court decree | s.30 |
Appeals against the Tribunal's own orders are governed by section 18 of the TRAI Act, 1997 (s.29(9)). Civil courts cannot hear matters the Board is empowered to decide, and no court may grant an injunction against action taken under the Act (s.39).
When this applies
The Board's inquiry, penalty and appeal provisions (s.27 except s.27(1)(d), and ss.28 to 34) and Rule 22 come into force eighteen months from 13 November 2025 (commencement note under s.1(2); Rule 1(4)). Section 27(1)(d) applies from one year. Prepare now with how to prepare for privacy complaints and the Board and enforcement overview.
Frequently asked questions
How do I file a complaint with the Data Protection Board of India?
First raise a grievance with the Data Fiduciary and wait for its response within its published period, which cannot exceed ninety days (s.13(3), Rule 14(3)). The Board must, as far as practicable, function as a digital office with complaints received digitally (s.28(1)).
How long does a Data Protection Board inquiry take?
Rule 19(9) requires the inquiry to be completed within six months of receiving the intimation or complaint, extendable by the Board for up to three months at a time with written reasons.
Can the Data Protection Board award compensation?
The Act does not provide for compensation to complainants. The Board can issue directions and impose penalties, and penalties are credited to the Consolidated Fund of India (s.34).
Where do I appeal a Data Protection Board order?
To the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal (s.2(a)), within sixty days of receiving the order (s.29(2)). The appeal is filed in digital form with the prescribed fee (Rule 22).
Can I sue in a civil court instead of going to the Board?
Section 39 bars civil courts from entertaining any suit or proceeding on a matter the Board is empowered to decide under the Act.
Practical next step
Rehearse one complaint end to end: grievance intake, response within your published period, and the evidence pack you would give the Board. Then run a quick external check of your public grievance details.