Enforcement

Section 18(1) establishes, from a date the Central Government notifies, "a Board to be called the Data Protection Board of India". Section 18(2) makes it a body corporate that can hold property, contract, and sue or be sued in its own name, and Section 18(3) leaves its headquarters to be notified.

The Board consists of a Chairperson and as many other Members as the Central Government notifies (Section 19(1)), appointed by the Central Government in the manner prescribed (Section 19(2)). Section 19(3) asks for people of ability, integrity and standing with special knowledge or practical experience in fields such as data governance, consumer protection law, dispute resolution, information technology, the digital economy, law or regulation, and requires that at least one Member be an expert in law.

Rule 17 supplies the appointment machinery, in force since 13 November 2025. A Search-cum-Selection Committee chaired by the Cabinet Secretary recommends candidates for Chairperson (Rule 17(1)); a second committee chaired by the Secretary of the Ministry of Electronics and Information Technology recommends other Members (Rule 17(2)); the Central Government appoints from those recommendations (Rule 17(3)).

Terms are short. Section 20(2) gives the Chairperson and Members a two-year term with eligibility for re-appointment, and Section 20(1) says their conditions of service cannot be varied to their disadvantage after appointment. Rule 18 points to the Fifth Schedule for those conditions: a consolidated monthly salary of four lakh fifty thousand rupees for the Chairperson and four lakh rupees for a Member, without house or car, and no pension or gratuity for service on the Board.

Section 21 lists the disqualifications, among them insolvency, conviction for an offence involving moral turpitude, incapacity, a prejudicial financial interest, and abuse of position, and Section 21(2) bars removal without a hearing. Section 22 covers resignation and vacancies, and Section 22(3) stops a former Chairperson or Member taking employment for one year after leaving without the Central Government's approval.

Section 28(1) sets the tone for everything that follows: the Board "shall function as an independent body" and, as far as practicable, "as a digital office", with complaints received, allocated, heard and decided "digital by design". Rule 20, in force since 13 November 2025, repeats the instruction and allows techno-legal measures so that proceedings do not require anyone's physical presence, while preserving the power to summon a person and examine her on oath. For a small business this means an inquiry is likely to be a matter of uploads, filings and video hearings rather than visits.

Section 23(1) leaves meeting procedure and the authentication of orders to the Rules, and Rule 19 provides it. The Chairperson fixes meetings and their agenda (Rule 19(1)); one-third of the membership is a quorum (Rule 19(3)); questions are decided by majority, with the chair holding a casting vote (Rule 19(4)); a Member with an interest in an item does not take part (Rule 19(5)); in an emergency the Chairperson may act alone, reporting to Members within seven days for ratification (Rule 19(6)). Most important for a business under inquiry, Rule 19(9) requires the inquiry to be completed within six months of receiving the intimation, complaint, reference or direction, extendable for recorded reasons by not more than three months at a time.

Section 23(2) protects the Board's acts from being invalidated by a vacancy, a defect in an appointment or a procedural irregularity that does not affect the merits. Section 23(3) puts the senior-most Member in charge when the Chairperson is unavailable.

Section 26 gives the Chairperson general superintendence over administration, the power to authorise officers to scrutinise complaints and correspondence, and the power to allocate proceedings to an individual Member or a group of Members. Section 24 and Rule 21 let the Board appoint officers and employees with the Central Government's approval, on the terms in the Sixth Schedule, which allows staff on deputation from Government and public bodies for up to five years. Section 25 deems the Chairperson, Members, officers and employees to be public servants when acting under the Act. Rules 19 and 21 and the Sixth Schedule have been in force since 13 November 2025.

Section 27(1) lists the ways a matter comes before the Board. On receiving a breach intimation from a Data Fiduciary, the Board may direct urgent remedial or mitigation measures, inquire into the breach and impose a penalty. On a complaint by a Data Principal about a personal data breach, about a Data Fiduciary's failure to meet its obligations in relation to her personal data, or about the exercise of her rights, or on a reference from the Central or a State Government, or on a court's direction, it inquires and may impose a penalty. It does the same on a complaint against a Consent Manager, on an intimation that a Consent Manager has breached a condition of registration, and on a Government reference that an intermediary has ignored a blocking direction under Section 37(2). Module 3 explains the grievance step a Data Principal must take with the Data Fiduciary before approaching the Board.

Section 28 sets out the procedure. The Board first decides whether there are sufficient grounds to proceed (Section 28(3)); if not, it closes the matter with recorded reasons (Section 28(4)); if so, it may inquire into the affairs of any person to check compliance (Section 28(5)), following the principles of natural justice and recording reasons as it goes (Section 28(6)).

For that inquiry Section 28(7) gives the Board the powers of a civil court to summon and examine people on oath, receive evidence on affidavit, require the production of documents, and inspect data, books and records. Section 28(8) draws a line: the Board and its officers "shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person". Section 28(9) lets it call on police or Government officers for assistance, and Section 28(10) allows interim orders after a hearing.

At the end, after hearing the person concerned, the Board either closes the proceedings or moves to Section 33 (Section 28(11)). Section 28(12) cuts the other way: a complaint the Board finds false or frivolous can earn the complainant a warning or costs. Alongside all this, Section 27(2) lets the Board issue binding directions after a hearing, and Section 27(3) lets it modify, suspend or withdraw them.

Two powers sit with the Central Government rather than the Board, and both can reach a business directly.

Section 36 lets the Central Government require the Board, any Data Fiduciary or any intermediary "to furnish such information as it may call for" for the purposes of the Act. Rule 23, which applies from 13 May 2027, narrows how that is done. Under Rule 23(1) the demand must be for one of the purposes in the Seventh Schedule, must come through the authorised person the Seventh Schedule names for that purpose, and must give a period within which to respond. The Seventh Schedule lists three purposes: use of personal data by the State in the interest of the sovereignty and integrity of India or the security of the State; use by the State to perform a function or fulfil a disclosure obligation under law; and carrying out the assessment for notifying a Data Fiduciary as a Significant Data Fiduciary. Rule 23(2) allows the Government, where disclosure would prejudice sovereignty or security, to require the Data Fiduciary not to tell the affected Data Principal or anyone else that information was furnished, except with the authorised person's written permission.

Section 37 is the Act's strongest non-monetary consequence. It applies only after the Board has imposed a monetary penalty on a Data Fiduciary "in two or more instances" and refers the matter, advising in the interests of the general public that access be blocked to information in a computer resource that enables the Data Fiduciary to offer goods or services to Data Principals in India (Section 37(1)). The Central Government must give the Data Fiduciary a hearing, be satisfied that blocking is necessary or expedient, and record its reasons before directing an agency or intermediary to block access. Section 37(2) binds every intermediary that receives such a direction. The terms "computer resource", "information" and "intermediary" take their meanings from the Information Technology Act, 2000 (Section 37(3)).

Neither power is routine. Section 36 is a request for information; Section 37 is a last step after repeated penalties. Both are worth knowing so that a demand, if it comes, is recognised for what it is.

Not every complaint ends in a penalty, and the Act builds in two ways out.

Section 31 allows mediation. If the Board is of the opinion that a complaint may be resolved that way, it may direct the parties to attempt resolution through a mediator they mutually agree on, or through mediation provided for under any other law in force in India. The Board does not mediate itself; it sends the parties to do so.

Section 32 allows a voluntary undertaking. Under Section 32(1) the Board may accept one "from any person at any stage of a proceeding under Section 28", in respect of any matter related to observance of the Act. Section 32(2) describes what it can contain: an undertaking to take a specified action within a time the Board sets, to refrain from an action, or to publicise the undertaking. Section 32(3) lets the Board vary the terms later, but only with the consent of the person who gave it.

The value of an undertaking lies in Section 32(4): once accepted, it "shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking". A business that has found and fixed a problem can, in effect, settle the matter by committing to the fix. The bar has one exception. Section 32(5) says a failure to adhere to any term is deemed a breach of the Act, and the Board may, after a hearing, proceed under Section 33. The Schedule to the Act matches this with its sixth row, covered in the next lesson.

For a small business, the practical sequence is: keep a record of what went wrong and what was done about it, so that if a matter reaches the Board there is a credible undertaking to offer.

Section 33(1) is the gate. Only if the Board "determines on conclusion of an inquiry" that a breach of the Act or the Rules "is significant" may it, after giving the person an opportunity of being heard, impose the monetary penalty specified in the Schedule to the Act. A penalty is the end of an inquiry, not the start of one, and it follows a finding that the breach was significant.

Section 33(2) lists what the Board must weigh in fixing the amount: the nature, gravity and duration of the breach; the type and nature of the personal data affected; whether the breach is repetitive; whether the person gained or avoided a loss as a result; whether the person acted to mitigate the effects, and how timely and effective that action was; whether the penalty is proportionate and effective in securing observance and deterring breach; and the likely impact of the penalty on the person.

The Schedule to the Act has seven rows. Every figure is a ceiling; the gazette's words are "may extend to".

1. Failing the Data Fiduciary's obligation to take reasonable security safeguards to prevent personal data breach: may extend to two hundred and fifty crore rupees.
2. Failing to give the Board or the affected Data Principal notice of a personal data breach: may extend to two hundred crore rupees.
3. Breach of the additional obligations in relation to children: may extend to two hundred crore rupees.
4. Breach of the additional obligations of a Significant Data Fiduciary: may extend to one hundred and fifty crore rupees.
5. Breach of the duties of a Data Principal: may extend to ten thousand rupees.
6. Breach of any term of a voluntary undertaking accepted by the Board under Section 32: up to the extent applicable for the breach in respect of which the proceedings under Section 28 were instituted.
7. Breach of any other provision of the Act or the Rules: may extend to fifty crore rupees.

The provision page for the Schedule carries the rows verbatim, with their cross-references to the sections they enforce.

Section 34 settles where the money goes: all sums realised by way of penalty are credited to the Consolidated Fund of India. A penalty is not compensation, and none of it is paid to the affected Data Principal.

Section 29(1) gives "any person aggrieved by an order or direction made by the Board" a right of appeal to the Appellate Tribunal. Section 29(2) sets the time limit at sixty days from the date of receipt of the order or direction, in the prescribed form and with the prescribed fee; Section 29(3) lets the Tribunal admit a late appeal for sufficient cause. After hearing the parties, the Tribunal may confirm, modify or set aside the order (Section 29(4)) and must send a copy of its order to the Board and the parties (Section 29(5)). Section 29(6) asks it to endeavour to dispose of the appeal within six months, and Section 29(7) requires written reasons if it cannot. Section 29(10) makes the Tribunal, like the Board, a digital office. The Act borrows the Tribunal and parts of its procedure from the Telecom Regulatory Authority of India Act, 1997, and a further appeal from the Tribunal follows the route in that Act (Section 29(8) and Section 29(9)).

Rule 22, which applies from 13 May 2027, adds the mechanics. The appeal is filed in digital form as the Tribunal decides (Rule 22(1)). The fee is the same as for an appeal under the Telecom Regulatory Authority of India Act, 1997, payable digitally through the Unified Payments Interface or another system authorised by the Reserve Bank of India, and the Tribunal's Chairperson may reduce or waive it (Rule 22(2)). Rule 22(3) frees the Tribunal from the Code of Civil Procedure, 1908, while binding it to the principles of natural justice.

Section 30 gives a Tribunal order the force of a civil court decree, executable by the Tribunal itself or by a local civil court to which it transmits the order.

Three provisions set the boundary with the ordinary courts. Section 39 bars civil courts from entertaining any suit on a matter the Board is empowered to decide and forbids injunctions against action taken under the Act; the route is the Board, then the Tribunal. Section 35 protects the Central Government, the Board and its people from suits for anything done in good faith under the Act. Section 38 places the Act alongside other laws rather than in place of them, and where the two conflict, Section 38(2) says the Act prevails to the extent of the conflict.