What Is the Data Protection Board of India? Powers, Penalties and How a Complaint Against a BFSI Institution Actually Proceeds

Section 18 of the DPDP Act provides that the Central Government establishes the Board by notification, and that it is a body corporate with perpetual succession and a common seal, able to acquire property, enter contracts, and sue or be sued, with its head office at a place the Central Government notifies. The establishing notification, G.S.R. 844(E), was issued in exercise of powers under sub-sections (1) and (3) of Section 18.

The Board sits under the Ministry of Electronics and Information Technology. MeitY issued both the establishment notification and the DPDP Rules, 2025, and MeitY’s Secretary sits on the Search-cum-Selection Committee for Members.

On composition, Section 19 provides that the Board consists of a Chairperson and such number of other Members as the Central Government notifies. Appointees must be persons of ability, integrity and standing with special knowledge or experience in fields including data governance, administration or implementation of laws relating to social or consumer protection, dispute resolution, information and communication technology, digital economy, law, regulation or techno-regulation, and at least one Member must be an expert in the field of law. PIB’s official backgrounder on the DPDP Rules describes a fully digital Data Protection Board of India “which will consist of four members”, and records that appeals against the Board’s decisions go to the Appellate Tribunal, TDSAT.

Under Section 20, the Chairperson and Members hold office for a term of two years and are eligible for re-appointment, and their salary and terms cannot be varied to their disadvantage after appointment.

The Board’s function is adjudicatory. Every power in Section 27(1) is triggered by an intimation, a complaint, a Central Government reference or a court direction reaching the Board, and Section 28(2) repeats that the Board acts on one of those four triggers. The comparison table further down sets that against how RBI penalises a bank.

For the Act’s own history, passage and rights catalogue, see our explainer on the DPDP Act. For who counts as a data fiduciary and what its obligation set covers, see data fiduciary under the DPDP Act, and for the processor side, data processor under the DPDP Act.

MeitY notification G.S.R. 843(E) dated 13 November 2025 brought the DPDP Act into force in three stages:

Sections 18 to 26 are the Board’s establishment, composition, appointment, terms of service, officers and meetings provisions. Sections 27 to 34 are its powers, inquiry procedure, appeal route, mediation, voluntary undertakings and penalty provisions. Read the two buckets against each other and the effect of the notification is that the institution is live and the machinery is not.

The Rules follow the same shape. The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E), New Delhi, dated the 13th November 2025 under sub-sections (1) and (2) of Section 40 of the Act, after a draft (G.S.R. 02(E), 3 January 2025) and public consultation. Rule 1 sets three stages: “Rules 1, 2 and 17 to 21 shall come into force on the date of their publication in the Official Gazette. Rule 4 shall come into force one year after the date of publication of this Gazette. Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.” PIB records that the Rules were finalised after nationwide consultations in Delhi, Mumbai, Guwahati, Kolkata, Hyderabad, Bengaluru and Chennai drawing 6,915 inputs, and describes an eighteen-month phased compliance period.

Two things to note about dates. Both instruments say “eighteen months after the date of publication” rather than naming a date, so 13 May 2027 is a computed date, not a stated one: the one-year stage computes to 13 November 2026 on the same basis. And the gazette instruments themselves are dated 13 November 2025, while the PIB backgrounder dates the Rules to 14 November 2025. This piece uses the date printed on the instrument.

Section 27(1) sets out the Board’s powers. On receiving intimation of a personal data breach, it can direct urgent remedial or mitigation measures, inquire into the breach and impose a penalty. It can inquire into a complaint by a Data Principal about a Data Fiduciary’s breach of its obligations, or act on a reference by the Central Government or a direction of a court. It can inquire into a complaint about a Consent Manager’s breach of its obligations, and on intimation of a Consent Manager’s breach of its registration conditions, inquire and impose a penalty. On a Central Government reference, it can inquire into an intermediary’s breach of Section 37(2) obligations. Of these, only the Consent Manager registration-condition limb, Section 27(1)(d), commences at the one-year mark rather than at eighteen months.

Under Section 27(2), after giving an opportunity of being heard and recording reasons in writing, the Board may issue such directions as it considers necessary. Section 27(3) lets it modify, suspend, withdraw or cancel a direction on a representation or a Central Government reference.

On penalties, Section 33(1) provides that if the Board determines on conclusion of an inquiry that a breach of the Act or Rules is significant, it may, after giving the person an opportunity of being heard, impose the monetary penalty specified in the Schedule. Section 33(2) lists the factors it must weigh in setting the amount: the nature, gravity and duration of the breach; the type and nature of the personal data affected; the repetitive nature of the breach; whether the person realised a gain or avoided a loss; whether the person acted to mitigate effects and consequences, and how timely and effective that action was; whether the penalty is proportionate and effective for securing observance and deterrence; and the likely impact of the penalty on the person.

Read the Schedule and Section 33(2) together and the structure is a ceiling per breach category, with repetition treated as a factor in fixing the amount inside that ceiling.

The same backgrounder confirms that failure to notify the Board or affected individuals of a breach, and violations of obligations relating to children, can each attract penalties of up to ₹200 crore, and that any other violation of the Act or Rules by a Data Fiduciary may attract penalties up to ₹50 crore.

No Indian institution has been penalised under the DPDP Act. Section 33 is not yet in force and the Board had no appointed members as of 1 August 2026.

This is the procedure that applies once Sections 27 to 34 commence:

• The Data Principal goes to the institution before the Board. Section 13(3)requires a Data Principal to exhaust the institution’s own grievance-redressal mechanism before approaching the Board.
• Once commenced, the Board will screen before it inquires. Under Section 28, the Board functions as an independent body and, as far as practicable, as a digital office, with receipt of complaints and the allocation, hearing and pronouncement of decisions digital by design (28(1)). It may act on an intimation, complaint, reference or direction under s.27(1) (28(2)). It first determines whether there are sufficient grounds to proceed with an inquiry (28(3)), and if not, may close proceedings for reasons recorded in writing (28(4)).
• If it proceeds, it has civil-court powers with one operational limit. Where there are sufficient grounds, the Board may inquire into the affairs of any person (28(5)) following the principles of natural justice and recording reasons (28(6)). It holds civil-court powers of summoning, examining evidence and inspecting documents (28(7)). It may not prevent access to premises or take custody of equipment in a way that adversely affects day-to-day functioning (28(8)). It may issue interim orders after a hearing and for recorded reasons (28(10)).
• There is a clock. Rule 19(9) requires the inquiry to be completed within six months of receipt of the intimation, complaint, reference or direction, extendable by the Board for recorded reasons for a further period not exceeding three months at a time.
• The inquiry will end in one of two ways. On completion, after a hearing, the Board either closes the proceedings or proceeds under Section 33 (28(11)). Where it considers a complaint false or frivolous, Section 28(12) lets it issue a warning or impose costs on the complainant.
• Two off-ramps exist. Section 31 lets the Board direct parties to mediation where it thinks a complaint can be resolved that way, and Section 32 provides for voluntary undertakings. Both are in the eighteen-month bucket.

Each item below is a specific Rule obligation, and each sits in the eighteen-month bucket under Rule 1(4) rather than applying today:

• 1. A notice that tells the customer how to complain to the Board

  Rule 3requires the notice to be independently understandable, to give in clear and plain language an itemised description of the personal data and the specified purpose plus a specific description of the goods, services or uses enabled, and to give the particular communication link for the fiduciary’s website or app along with a description of other means by which the Data Principal may withdraw consent with comparable ease, exercise her rights under the Act, and make a complaint to the Board.

• 2. A published rights-request route

  Rule 14(1) requires the Data Fiduciary, and where applicable the Consent Manager, to prominently publish on its website or app the means by which a Data Principal may make a request to exercise her rights, and the particulars such as a username or other identifier required to identify her.

• 3. A grievance system that answers within ninety days

  Rule 14(3)requires prominent publication of the grievance-redressal system “within a reasonable period not exceeding ninety days” and implementation of technical and organisational measures to ensure the system actually responds within that period.

• 4. Access logs retained for a year

  Rule 6(1) sets minimum reasonable security safeguards: encryption, obfuscation, masking or virtual tokens; access controls on computer resources; visibility on access to personal data through appropriate logs, monitoring and review to enable detection, investigation and remediation of unauthorised access; backups for continued processing; retention of such logs and personal data for one year unless another law requires otherwise; contractual provision for security safeguards in the fiduciary-processor contract; and appropriate technical and organisational measures.

• 5. A breach-notification runbook with a seventy-two-hour tail

  Rule 7requires the Data Fiduciary, on becoming aware of a personal data breach, to intimate each affected Data Principal without delay through her user account or registered channel with the breach’s nature, extent and timing, the consequences relevant to her, mitigation measures implemented, safety measures she may take, and business contact information for a person who can answer her queries. It must also intimate the Board without delay with the breach’s nature, extent, timing, location and likely impact, followed within seventy-two hours (or a longer period the Board allows on written request) by updated and detailed information, the broad facts and reasons leading to the breach, mitigation measures implemented or proposed, findings on who caused it, remedial measures to prevent recurrence, and a report on the intimations given to affected Data Principals.

• 6. An annual DPIA and audit, if designated significant

  Rule 13(1) and (2) require a Significant Data Fiduciary, once every twelve months from the date it is notified as such, to undertake a Data Protection Impact Assessment and an audit, and to have the person carrying them out furnish a report to the Board containing significant observations.

Two published pieces on the Board are summarised below as their authors made them. Both are argument, not statute:

How an adjudication under the DPDP Act compares structurally with an RBI supervisory enforcement on a bank:

The RBI action above is a banking-law penalty under the Banking Regulation Act, 1949. It is not a DPDP action, and it is included as an illustration of how a supervisory penalty is framed. RBI’s own release records that the action is “based on deficiencies in regulatory compliance and is not intended to pronounce upon the validity of any transaction or agreement entered by the bank with its customers.”

Read together, the commencement notification and Section 39 describe a window in which the bar on court jurisdiction operates ahead of the Board’s own powers. Section 39’s bar on civil-court jurisdiction over matters the Board is empowered over has been in force since 13 November 2025, while Sections 27 to 34, apart from Section 27(1)(d) at the one-year mark, do not commence for eighteen months, and no Chairperson or Members had been appointed as of 1 August 2026. The practical implication is that neither side of a data-protection dispute has the forum the Act contemplates for it during this window, which is the gap the LiveLaw piece describes when it reports courts directing litigants to a Board that is not functioning.

A second reading concerns the sequencing. Rules 19 and 20, which set the six-month inquiry clock and the digital-office mandate, are in the immediate-commencement bucket, while the powers those rules govern are in the eighteen-month bucket. This suggests the procedural scaffolding was put in place ahead of the jurisdiction it will carry, which is consistent with PIB’s description of an eighteen-month phased compliance period.

For a compliance team deciding what to build first, the cited provisions suggest an order. Section 33(2) directs the Board to weigh how timely and effective a person’s mitigation was, and separately to weigh the repetitive nature of the breach, within a ceiling set per breach category. Set that against Rule 7’s seventy-two-hour requirement for detailed follow-up to the Board and Rule 6(1)’s requirement to retain access logs and personal data for one year, and the reading is that the log-retention and monitoring capability is what makes a seventy-two-hour report answerable at all. An institution that stands up Rule 6(1) logging only on the day Rule 7 begins to bite has no retained history to report from, because the one-year retention window Rule 6(1) specifies would only start running at that point.

A last reading concerns the relationship with RBI. Section 38 makes the DPDP Act additive to other laws in force, and RBI’s own framing records that a monetary penalty is without prejudice to any other action. Read together, these suggest that an RBI finding on non-compliance with certain KYC directions and the DPDP obligations are separate items, running on different triggers, under different statutes, at different scales, so closing out one addresses the obligation it arises under. On timing, Sections 27 to 34 have not commenced, so the DPDP side of that comparison cannot yet be inquired into or penalised. The DPDP Schedule’s top ceiling is ₹250 crore, against the ₹50,000 in the single RBI action cited above, though a ceiling and one illustrative penalty are not like-for-like figures.