Data Protection Board of India

The Data Protection Board of India is a quasi-judicial regulatory body established under Section 18 of the Digital Personal Data Protection Act, 2023. It is the central enforcement authority for the Act — responsible for holding Data Fiduciaries accountable, protecting the rights of Data Principals, and ensuring that organisations handling personal data in India comply with the law.

Unlike traditional regulators, the Board has a dual role. First, it is an investigative authority that can look into complaints, conduct inquiries, and gather evidence. Second, it is an adjudicatory authority that hears both sides, passes reasoned orders, and imposes civil penalties. This dual role makes the Board one of the most powerful privacy regulators in the world, comparable to the GDPR's Data Protection Authorities but with a more centralised, tribunal-style structure.

The Board is not a court, but it exercises powers similar to a civil court under the Code of Civil Procedure, 1908. Its orders are binding, and non-compliance with its directions can attract additional penalties of up to ₹150 crore.

The Board consists of a Chairperson and such number of other members as the Central Government may determine. The Act does not prescribe a fixed number of members, giving the government flexibility to scale the Board based on workload and evolving needs.

The Chairperson must have at least 10 years of experience in data protection, law, technology policy, or a related field. Members are appointed based on their expertise in law, data protection, cyber security, technology, or public administration. The appointment process is designed to ensure independence and technical competence — a critical requirement for a regulator dealing with complex, fast-moving technology issues.

The Chairperson and members hold office for a term prescribed by the Central Government and are eligible for reappointment. They can be removed only on grounds of misbehaviour or incapacity, after an inquiry by a Supreme Court judge — a protection designed to shield the Board from political interference.

The Board is supported by a secretariat and can hire officers, consultants, and experts as needed. It is empowered to establish offices at multiple locations across India, though the Act does not mandate a specific headquarters.

Any person aggrieved by an order of the Board may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) under Section 29 of the Act. The appeal must be filed within 60 days of receiving the Board's order. The TDSAT may condone delay if sufficient cause is shown.

The TDSAT has the power to hear the appeal, examine the record, and pass such orders as it deems fit — including setting aside, modifying, or confirming the Board's order. Its decision is final and binding, though it can be challenged before the Supreme Court under Article 136 of the Constitution.

Importantly, filing an appeal does not automatically stay the Board's order. The appellant must seek a stay from the TDSAT, which may grant it on such terms as it considers appropriate.

For organisations handling personal data in India, the Data Protection Board is not a distant regulator — it is an active enforcement authority with significant powers and a clear mandate. The practical implications are:

• Compliance is no longer optional. The Board can investigate suo motu (on its own motion), so even without a complaint, non-compliance can be caught.
• Documentation matters. The Board will examine whether the Data Fiduciary took "reasonable security safeguards" — so policies, audits, and incident response plans must be documented.
• Breach notification is time-bound. Failure to notify a breach can attract a penalty of up to ₹200 crore — separate from the penalty for the breach itself.
• Directors and officers can be held liable. The Act allows the Board to proceed against individuals responsible for the breach, not just the company.
• Appeals are possible but not automatic. Organisations should build a strong record at the Board level, because TDSAT appeals are not a guaranteed remedy.