Chapter 12: Data Protection Board

Board structure, functions, and procedures

chapter · 2 min read · Updated 14-Feb-2026 · 12 of 14

Executive Summary

•The Referee. The Data Protection Board of India is the body that enforces the rules, investigates breaches, and imposes penalties. It is 'digital-by-design'.

Institutional Impact

•No Courtroom Drama: The Board functions digitally. Hearings and submissions are likely to be online.
•Inquiry: If they suspect non-compliance, they can call for information. If you lie or withhold info, that's a separate penalty.

Data Principal Rights

•The Appeal: If the company ignores your grievance, you escalate it here.

Practical application

What this looks like in practice

Use these examples to distinguish a defensible process from a common mistake.

Right

✓An organization responds to a Board inquiry through the designated digital process and preserves the supporting records.

Incorrect

×A business ignores a formal request for information or supplies incomplete records during an inquiry.

Official Reference & Scope

•Sections 18-28: Data Protection Board and its procedure
•Section 29: Appeals
•Rules 17-21: Board appointments, meetings, digital office, and staff
•Rule 22: Appeal to Appellate Tribunal

Establishes the Data Protection Board's composition, powers, and operational procedures.

Board composition: Chairperson and members
Powers and functions: Regulatory and adjudicatory authority
Procedures: How the Board conducts proceedings
Appeals: Appellate mechanisms

Rule 19 covers Board meetings and inquiry timing, rule 20 provides for functioning as a digital office, and rule 22 governs digital appeals to the Appellate Tribunal. Rule 12 concerns specified exemptions relating to children's data, not Board procedure.

Primary sources: sections 18-29 of the DPDP Act and rules 17-22 of the DPDP Rules.

Back to list

Chapter 11: Data Fiduciaries & SDFs Next: Chapter 13: Inquiry, Penalties, and Appeals