Introduction
In our previous lessons, we've explored the core obligations that the Digital Personal Data Protection (DPDP) Act, 2023, places on organizations—from obtaining consent and relying on legitimate uses to the nuanced rules for transferring data across borders. We have built a solid understanding of the rules of the game. Now, we turn to the referee.
A law's effectiveness hinges on its enforcement. This lesson is dedicated to the primary enforcement and adjudicatory body established by the Act. We will explain the role, powers, and penalty framework of the Data Protection Board of India (DPB). For your goal of mastering AI governance, understanding this institution is critical. It's where legal principles meet real-world consequences, and where the accountability of tech companies, including those deploying AI, is ultimately decided.
1. The Role and Structure of the Data Protection Board
The DPDP Act creates a new institution, the Data Protection Board of India (DPB), to serve as the primary body for enforcing the law. It is crucial to understand that the DPB is an adjudicatory body, not a policy-making or rule-making one. Its main function is to hear complaints, inquire into breaches, and impose penalties.
To get a precise legal understanding of the DPB's structure and unique operational design, please start by reading the foundational chapter of the Act itself.
THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
The following is Chapter V of the DPDP Act, 2023. It legally establishes the Board and defines its composition, the qualifications of its members, and their terms of service.
Please read Chapter V (Establishment of Data Protection Board of India), which covers Sections 18 through 25. As you read, focus on: Section 18: The legal status of the Board as a 'body corporate'. Section 19: The composition of the Board and the required expertise of its members. Note the specific mention of legal expertise. Section 20: The term of office for members. Section 23: The provision for the Board to function and hold meetings by 'digital means'.
As you've just read in the primary text, the DPB is designed with some distinct features:
- Corporate and Legal Personality: Section 18 establishes the Board as a "body corporate," meaning it has a separate legal identity. It can own property, enter into contracts, and importantly, sue or be sued in its own name.
- Expert Composition: The Board is not intended to be a purely bureaucratic body. Section 19 mandates that its Chairperson and Members must have special knowledge in relevant fields like data governance, technology, and law. The requirement that at least one member be a legal expert underscores the judicial nature of its functions.
- "Digital by Design": A standout feature is the mandate for the Board to function as a "digital office" (Section 28(1), which we will explore next). This means everything from filing complaints to conducting hearings and delivering judgments is intended to be handled online. Given your experience with digital transformation, you can appreciate the intent to build a more efficient, accessible, and transparent adjudicatory process from the ground up.
The following video provides a concise overview of this digital-first approach and the Board's overall purpose.
Digital Personal Data Protection Rules 2025: Complete Breakdown | UPSC Current Affairs 2025
This clip from Vision IAS explains the key functions of the Data Protection Board and its design as an online body.
Watch the segment from 21:35 to 23:11. Pay attention to how the video describes the Board's powers to investigate, conduct hearings, and ensure uniform implementation of the Act across all sectors.
2. Powers and Functions of the Board
Now that we understand the Board's structure, let's examine its powers. The DPB acts when a rule is potentially broken. Its authority is triggered in several specific ways, leading to a formal inquiry process.
For a detailed walkthrough of this process, the following video by legal professionals from Khaitan & Co is an excellent resource.
Digital Personal Data Protection Act,2023 A Tectonic Shift in the Data Protection Landscape in India
In this segment, the speakers detail the oversight and enforcement mechanisms of the Act, focusing on how the Data Protection Board initiates and conducts its inquiries.
Watch from 51:13 to 56:07. Focus on: The three primary ways the Board can take 'cognizance' of a contravention (complaint, intimation of breach, government reference). The inquiry process, which follows principles of natural justice. The two novel concepts introduced: Alternate Dispute Resolution (ADR) and Voluntary Undertaking.
To complement the video's explanation, we will now turn to the specific text of the law that grants these powers.
THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
Chapter VI of the DPDP Act is the source of the Board's authority. It outlines its specific functions and the legal powers it can exercise during an inquiry.
Please read Chapter VI (Powers, Functions and Procedure to be Followed by Board), focusing on Sections 27 and 28. As you read, note: Section 27: The list of specific breaches the Board is empowered to inquire into. Section 28(7): The specific powers vested in the Board from the Code of Civil Procedure, 1908, such as summoning individuals and requiring the production of documents. Section 28(12): The Board's power to issue warnings or impose costs on a complainant for a false or frivolous complaint.
Let's synthesize what we've learned from the video and the Act:
A. The Inquiry Process:
- Trigger: An inquiry can be initiated by:
- A complaint from a Data Principal.
- An intimation of a personal data breach from a Data Fiduciary.
- A reference from the Central or State Government.
- A direction from a court.
- Preliminary Assessment: The Board first determines if there are sufficient grounds to proceed. It can close the matter at this stage if the complaint is deemed baseless.
- Formal Inquiry: If grounds exist, the Board conducts an inquiry, following the principles of natural justice (e.g., giving both parties a fair opportunity to be heard).
- Powers of a Civil Court: During the inquiry, the Board can compel evidence by summoning persons, demanding documents, and inspecting data, much like a civil court.
- Outcome: Upon completion, the Board can issue binding directions, order remedial actions, or impose penalties.
B. Alternative Mechanisms:
The Act also incorporates modern governance tools to promote compliance and efficiency:
- Alternate Dispute Resolution (ADR): The Board can refer a complaint to mediation, allowing parties to resolve the issue without a full-blown adjudicatory process.
- Voluntary Undertaking: A person can offer a "voluntary undertaking" to the Board, committing to take or refrain from certain actions. If the Board accepts this, it acts as a bar on proceedings for that specific issue, offering a path for entities to proactively remedy a potential breach.
3. The Penalty Framework
The DPDP Act is designed with a strong deterrent effect, backed by a framework of substantial financial penalties. These are not nominal fines; they are significant enough to command the attention of the largest corporations.
The following image provides a clear, at-a-glance summary of the major categories of breaches and their corresponding maximum penalties as laid out in the Act's Schedule.
The key penalties to note are:
- Failure of Security Safeguards: Up to ₹250 crore for failing to take reasonable security measures to prevent a data breach.
- Failure to Notify: Up to ₹200 crore for failing to inform the Board and affected users about a breach.
- Breach Concerning Children's Data: Up to ₹200 crore for violating the additional obligations related to processing children's data.
How are Penalties Determined?
It is crucial to understand that these are maximum penalties. The Board does not apply them arbitrarily. Section 33(2) of the Act requires the Board to consider a range of factors to ensure the penalty is proportionate.
THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
Section 33 of the DPDP Act deals with penalties. Sub-section (2) is particularly important as it lists the criteria the Board must consider when deciding the quantum of a penalty.
Please read only Section 33 ('Penalties'). Focus on the list of matters in sub-section (2) that the Board must have regard to.
As you read, the Board must weigh factors such as:
- The nature, gravity, and duration of the breach.
- The type of personal data affected.
- The repetitive nature of the breach.
- Whether the person took action to mitigate the consequences.
- The need to be a proportionate deterrent.
This list of factors transforms the process from a simple punishment mechanism into a nuanced adjudicatory function, balancing deterrence with fairness.
Beyond Financial Penalties
The Board's enforcement power isn't limited to fines. In cases of repeated and serious non-compliance, it can recommend a more drastic measure.
Digital Personal Data Protection Act,2023 A Tectonic Shift in the Data Protection Landscape in India
In this Q&A segment from the Khaitan & Co webinar, a speaker clarifies what other actions can be taken against non-compliant entities, beyond just monetary penalties.
Watch the answer to the first question, from 1:12:12 to 1:13:30. Note the government's power to block access to a platform on the Board's recommendation.
As the video explains, upon the Board's recommendation (e.g., after a Data Fiduciary has been penalized on two or more instances), the Central Government has the power under Section 37 to block public access to that entity's platform or service. This is a significant power, reserved for serious cases where financial penalties are insufficient to ensure compliance.
Test your understanding!
A digital health startup, "CareAI," which you once consulted for, suffers a major data breach affecting 500,000 users, including 50,000 minors. The breached data includes sensitive health information. The company discovers the breach but, fearing reputational damage, decides not to inform the Data Protection Board or its users for two months. An internal investigation reveals that the breach occurred because the company failed to implement industry-standard encryption on a backup server.
- Based on the Schedule of the DPDP Act, what are the primary breaches CareAI has committed?
- If the Board were to impose a penalty, what factors from Section 33(2) would likely lead to a higher penalty amount?
Show answer
-
Primary Breaches:
- Breach of Section 8(5): Failure to take "reasonable security safeguards to prevent personal data breach." This carries a maximum penalty of up to ₹250 crore.
- Breach of Section 8(6): Failure to give the Board or affected Data Principals "notice of a personal data breach." This carries a maximum penalty of up to ₹200 crore.
- Breach of Section 9: Breach in observance of "additional obligations in relation to children." Since the data of 50,000 minors was affected, this is a significant violation, carrying a maximum penalty of up to ₹200 crore.
-
Aggravating Factors for Penalty Calculation (Section 33(2)):
- (a) Nature and Gravity: The breach involved sensitive health information, which is highly grave. The duration was prolonged by the company's failure to notify.
- (b) Type of Personal Data: The data was highly sensitive and involved minors, which the Act treats with a higher degree of care.
- (e) Mitigation Actions: The company's decision to actively conceal the breach, rather than mitigate its effects by notifying users, would be a major aggravating factor. This demonstrates bad faith.
- (f) Proportionality and Deterrence: The Board would likely impose a very substantial penalty to deter other companies, especially in the sensitive healthcare sector, from similar negligence and concealment.
4. Appeals Process
A decision by the Data Protection Board is not the final word. The Act establishes a clear, three-tier appellate structure.
- Data Protection Board (DPB): The first level of adjudication.
- Telecom Disputes Settlement and Appellate Tribunal (TDSAT): Any person aggrieved by an order of the Board can appeal to the TDSAT (Section 29). This is an existing specialized tribunal whose jurisdiction has been expanded to hear these appeals.
- Supreme Court of India: A final appeal against an order of the TDSAT can be made to the Supreme Court.
This structure ensures that decisions are subject to judicial review by specialized and apex bodies, providing a crucial check on the Board's power. Furthermore, Section 39 of the Act explicitly bars ordinary civil courts from hearing matters that the Board is empowered to decide, channeling all disputes through this designated path.
Conclusion
In this lesson, we have dissected the enforcement heart of the DPDP Act. You now understand the institution responsible for holding data fiduciaries accountable.
Key Takeaways:
- Role and Structure: The Data Protection Board of India is a specialized, "digital by design" adjudicatory body responsible for enforcing the DPDP Act. It is composed of experts and functions independently.
- Powers: The Board can launch inquiries based on complaints, breach notifications, or government references. It possesses powers similar to a civil court to gather evidence and can issue binding directions and interim orders.
- Penalty Framework: The Act includes a schedule of substantial financial penalties (up to ₹250 crore) designed to be a strong deterrent. The final penalty amount is decided based on a set of factors ensuring proportionality.
- Appeals: A clear three-tier appeal process exists, running from the DPB to the TDSAT and finally to the Supreme Court, ensuring judicial oversight.
Preview of the Next Lesson:
While the DPDP Act is the primary legislation for data protection, it does not operate in a vacuum. Another cornerstone of India's digital legal framework is the Information Technology Act, 2000. In our next lesson, we will begin a new module and analyze the legal status of AI-generated outputs as 'electronic records' under the IT Act, exploring how this older law continues to shape the regulation of modern technology.