The Data Protection Board of India

What the Board does

The Board's functions are set out in section 27 of the Act.

• On a personal data breach intimation, direct urgent remedial or mitigation measures, inquire into the breach and impose a penalty
• On a complaint by a Data Principal, inquire into a breach of the Act and impose a penalty
• Inquire into references from the Central Government, a State Government or a court
• Inquire into breaches by Consent Managers and of their registration conditions
• Issue the directions it considers necessary to discharge its functions under the Act

A digital office

Section 28 requires the Board to function as an independent body and, as far as practicable, as a digital office. Receiving complaints, allocating them, hearing them and pronouncing decisions are meant to be digital by design. Expect filings, notices and hearings to happen online, so your responses and evidence should be ready in digital form.

How complaints reach the Board

A Data Principal must first use the Data Fiduciary's grievance redressal mechanism before approaching the Board. If a customer of a D2C brand asks for erasure, receives no response within the period you publish, and then complains, the Board will look at what your records show about that request.

The Board can also direct the parties to mediation where it thinks the complaint may be resolved that way.

Voluntary undertakings

Under section 32, the Board may accept a voluntary undertaking from a person at any stage of proceedings. It can include taking specified action within a set time, refraining from an action, or publicising the undertaking. Acceptance bars proceedings on the contents of the undertaking, unless the person fails to keep to it. Breaching an accepted undertaking is treated as a breach of the Act, and the Board can impose a penalty after giving a hearing.

Appeals

Under section 29, a person aggrieved by an order or direction of the Board can appeal to the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal, within sixty days of receiving the order. The Tribunal can accept a late appeal if there was sufficient cause for the delay.

Data Principals have duties too

Section 15 gives Data Principals duties: to comply with applicable law, not to impersonate another person, not to suppress material information when providing personal data for a document issued by the State, not to register a false or frivolous grievance or complaint, and to give only verifiably authentic information when asking for correction or erasure. Breaching these can attract a penalty of up to 10,000 rupees.

How TrustOS helps

TrustOS keeps the records the Board is likely to ask for: each grievance and request with its timeline, breach intimations and reports, notices and consent versions, and evidence packs that can be verified cryptographically. When a complaint arrives, you can show what happened and when.

TrustOS does not represent you before the Board and does not decide whether to offer an undertaking or file an appeal. Those decisions belong with your counsel, and TrustOS does not replace legal advice.