FOCTTA, Orchestrating Privacy, Trust and Compliance
Readiness check Book a demo
Lesson 11 of 12 · 8 min read

Board, penalties and appeals

The Data Protection Board: who sits on it, how inquiries run, the penalty caps in the Schedule, and how appeals work.

Jump to the quiz

The Board

The Government established the Data Protection Board of India from 13 November 2025, with its head office in the National Capital Region, and fixed its size at four members. Members serve two years and can be reappointed. At least one must be an expert in law.

Search-cum-selection committees recommend candidates: the Cabinet Secretary chairs the one for the Chairperson, and the MeitY Secretary the one for Members. The Chairperson's salary is Rs 4.5 lakh a month and a Member's Rs 4 lakh, without house or car.

Sources: G.S.R. 844(E)G.S.R. 845(E)Act s.19Act s.20(2)

A digital office

The Board works as a digital office. Receiving complaints, hearings and decisions are to be digital by design. It can use techno-legal measures so that no one needs to attend in person, while keeping its power to summon people and examine them on oath.

Sources: Act s.28(1)Rules r.20

What the Board can act on

The Board acts on a breach intimation from a Fiduciary, or a person's complaint about a breach or an unmet duty. It also acts on references from the Central or a State Government, and on court directions. Other triggers are complaints against Consent Managers, breaches of their registration conditions, and references about intermediaries ignoring blocking directions. It can direct urgent remedial measures after a breach.

Sources: Act s.27

How an inquiry runs

The Board first decides whether there are sufficient grounds. If not, it closes the matter with written reasons. If so, it inquires following natural justice, with civil court powers to summon, take evidence and inspect documents. It must not take equipment or bar premises in ways that disrupt day-to-day functioning.

It can issue interim orders after a hearing. Rule 19(9) says an inquiry must finish within six months of receiving the matter, extendable by up to three months at a time with written reasons. The Board may warn or impose costs on a false or frivolous complainant.

Sources: Act s.28Rules r.19(9)

Penalties

If the Board finds a significant breach, it may impose a monetary penalty up to the Schedule's caps, after a hearing. It weighs the nature, gravity and duration of the breach, the data affected, repetition, and any gain made or loss avoided. It also weighs mitigation and its timeliness, proportionality, and the likely impact on the person.

The caps are Rs 250 crore for security safeguards, Rs 200 crore for breach notice and Rs 200 crore for children's duties. Next come Rs 150 crore for SDF duties, Rs 10,000 for Data Principal duties, and Rs 50 crore for any other breach. Penalties go to the Consolidated Fund of India.

The Government may amend the Schedule but cannot raise any penalty above twice its original amount. After penalties in two or more cases, the Board may advise, and the Government may order, blocking public access to a Fiduciary's platform in the public interest, after a hearing.

Sources: Act s.33Act s.34Act ScheduleAct s.42Act s.37

Settling and appealing

The Board may send a complaint to mediation, and may accept a voluntary undertaking at any stage of a proceeding. An accepted undertaking bars proceedings on its contents; breaking it is treated as a breach of the Act. Civil courts cannot hear matters the Board is empowered to decide.

Anyone aggrieved by a Board order can appeal to the Appellate Tribunal, which is TDSAT, within 60 days; late appeals are allowed for sufficient cause. The Tribunal aims to decide within six months. Rule 22 makes filing digital, with a fee like that for TRAI Act appeals, payable by UPI.

Sources: Act s.31Act s.32Act s.39Act s.29Rules r.22

Key points

  • The Board is a digital office with civil court powers.
  • Inquiries: six months, extendable by three months at a time.
  • Highest cap: Rs 250 crore for weak security safeguards.
  • Voluntary undertakings and mediation can settle matters.
  • Appeals go to TDSAT within 60 days.

In practice

A checklist for your organisation.

  • Keep evidence of safeguards and mitigation; the Board weighs both.
  • Prepare to receive and answer Board notices online.
  • Assign an owner for Board correspondence and deadlines.
  • Diary the 60-day appeal window from any Board order.

Check what you learned

5 questions. Choose an answer to see why it is right.

0 of 5 answered

  1. Question 1 of 5

    Where does an appeal against a Board order go?

    Show the answer

    A. The Appellate Tribunal (TDSAT)

    Section 29(1) provides for appeal to the Appellate Tribunal, which section 2(a) defines as the Telecom Disputes Settlement and Appellate Tribunal.

    Act s.29(1), s.2(a)

  2. Question 2 of 5

    Within how many days must an appeal normally be filed?

    Show the answer

    B. 60 days

    Section 29(2) requires an appeal within sixty days from receipt of the order or direction; section 29(3) allows late appeals for sufficient cause.

    Act s.29(2)

  3. Question 3 of 5

    What is the penalty cap for breaching the additional duties on children?

    Show the answer

    C. Rs 200 crore

    Item 3 of the Schedule: breach of the additional obligations in relation to children under section 9 may attract up to two hundred crore rupees.

    Act Schedule item 3

  4. Question 4 of 5

    What must the Board do before imposing a monetary penalty?

    Show the answer

    C. Give the person an opportunity of being heard

    Section 33(1) lets the Board impose a penalty for a significant breach only after giving the person an opportunity of being heard.

    Act s.33(1)

  5. Question 5 of 5

    Under Rule 19(9), within what period must a Board inquiry normally be completed?

    Show the answer

    D. Six months

    Rule 19(9) requires completion within six months of receiving the matter, extendable for reasons in writing by up to three months at a time.

    Rules r.19(9)

Official sources for this lesson

A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.