# Lesson 11: Board, penalties and appeals | Learn DPDP | FOCTTA > The Data Protection Board: who sits on it, how inquiries run, the penalty caps in the Schedule, and how appeals work. Web page: https://foctta.com/learn/board-penalties-appeals This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 11 Lesson 11 of 12 · 8 min read # Board, penalties and appeals The Data Protection Board: who sits on it, how inquiries run, the penalty caps in the Schedule, and how appeals work. Jump to the quiz ## Where things stand - The Board was established on 13 November 2025 and its size fixed at four members. Sections 18 to 26 and Rules 17 to 21 apply now. Checked 28 Sep 2026 Source: G.S.R. 844(E); G.S.R. 845(E); G.S.R. 843(E) para (a); Rules r.1(2) - On 6 May 2026 MeitY invited applications for one Chairperson post and four Member posts. No appointment was confirmed from a primary source. LiveLaw reported on 1 August 2026 that none had been made (secondary source). Checked 28 Sep 2026 Source: MeitY F. No. 2(1)/2026-Pers.I, 6 May 2026; appointment not confirmed - The Board's powers to act on breaches and complaints, inquiries, penalties and appeals (sections 27 to 34, Rule 22) start around May 2027. Its power over Consent Manager registration breaches, section 27(1)(d), starts in November 2026. Checked 28 Sep 2026 Source: G.S.R. 843(E) paras (b) and (c); Rules r.1(4) ## The Board The Government established the Data Protection Board of India from 13 November 2025, with its head office in the National Capital Region, and fixed its size at four members. Members serve two years and can be reappointed. At least one must be an expert in law. Search-cum-selection committees recommend candidates: the Cabinet Secretary chairs the one for the Chairperson, and the MeitY Secretary the one for Members. The Chairperson's salary is Rs 4.5 lakh a month and a Member's Rs 4 lakh, without house or car. Sources: G.S.R. 844(E) G.S.R. 845(E) Act s.19 Act s.20(2) ## A digital office The Board works as a digital office. Receiving complaints, hearings and decisions are to be digital by design. It can use techno-legal measures so that no one needs to attend in person, while keeping its power to summon people and examine them on oath. Sources: Act s.28(1) Rules r.20 ## What the Board can act on The Board acts on a breach intimation from a Fiduciary, or a person's complaint about a breach or an unmet duty. It also acts on references from the Central or a State Government, and on court directions. Other triggers are complaints against Consent Managers, breaches of their registration conditions, and references about intermediaries ignoring blocking directions. It can direct urgent remedial measures after a breach. Sources: Act s.27 ## How an inquiry runs The Board first decides whether there are sufficient grounds. If not, it closes the matter with written reasons. If so, it inquires following natural justice, with civil court powers to summon, take evidence and inspect documents. It must not take equipment or bar premises in ways that disrupt day-to-day functioning. It can issue interim orders after a hearing. Rule 19(9) says an inquiry must finish within six months of receiving the matter, extendable by up to three months at a time with written reasons. The Board may warn or impose costs on a false or frivolous complainant. Sources: Act s.28 Rules r.19(9) ## Penalties If the Board finds a significant breach, it may impose a monetary penalty up to the Schedule's caps, after a hearing. It weighs the nature, gravity and duration of the breach, the data affected, repetition, and any gain made or loss avoided. It also weighs mitigation and its timeliness, proportionality, and the likely impact on the person. The caps are Rs 250 crore for security safeguards, Rs 200 crore for breach notice and Rs 200 crore for children's duties. Next come Rs 150 crore for SDF duties, Rs 10,000 for Data Principal duties, and Rs 50 crore for any other breach. Penalties go to the Consolidated Fund of India. The Government may amend the Schedule but cannot raise any penalty above twice its original amount. After penalties in two or more cases, the Board may advise, and the Government may order, blocking public access to a Fiduciary's platform in the public interest, after a hearing. Sources: Act s.33 Act s.34 Act Schedule Act s.42 Act s.37 ## Settling and appealing The Board may send a complaint to mediation, and may accept a voluntary undertaking at any stage of a proceeding. An accepted undertaking bars proceedings on its contents; breaking it is treated as a breach of the Act. Civil courts cannot hear matters the Board is empowered to decide. Anyone aggrieved by a Board order can appeal to the Appellate Tribunal, which is TDSAT, within 60 days; late appeals are allowed for sufficient cause. The Tribunal aims to decide within six months. Rule 22 makes filing digital, with a fee like that for TRAI Act appeals, payable by UPI. Sources: Act s.31 Act s.32 Act s.39 Act s.29 Rules r.22 ## Key points - The Board is a digital office with civil court powers. - Inquiries: six months, extendable by three months at a time. - Highest cap: Rs 250 crore for weak security safeguards. - Voluntary undertakings and mediation can settle matters. - Appeals go to TDSAT within 60 days. ## In practice A checklist for your organisation. - Keep evidence of safeguards and mitigation; the Board weighs both. - Prepare to receive and answer Board notices online. - Assign an owner for Board correspondence and deadlines. - Diary the 60-day appeal window from any Board order. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### Where does an appeal against a Board order go? - The Appellate Tribunal (TDSAT) - The Supreme Court directly - MeitY - The High Court Show the answer **A. The Appellate Tribunal (TDSAT)** Section 29(1) provides for appeal to the Appellate Tribunal, which section 2(a) defines as the Telecom Disputes Settlement and Appellate Tribunal. Act s.29(1), s.2(a) 2. Question 2 of 5 ### Within how many days must an appeal normally be filed? - 30 days - 60 days - 90 days - 120 days Show the answer **B. 60 days** Section 29(2) requires an appeal within sixty days from receipt of the order or direction; section 29(3) allows late appeals for sufficient cause. Act s.29(2) 3. Question 3 of 5 ### What is the penalty cap for breaching the additional duties on children? - Rs 50 crore - Rs 150 crore - Rs 200 crore - Rs 250 crore Show the answer **C. Rs 200 crore** Item 3 of the Schedule: breach of the additional obligations in relation to children under section 9 may attract up to two hundred crore rupees. Act Schedule item 3 4. Question 4 of 5 ### What must the Board do before imposing a monetary penalty? - Nothing - Get court approval - Give the person an opportunity of being heard - Publish a draft order for comment Show the answer **C. Give the person an opportunity of being heard** Section 33(1) lets the Board impose a penalty for a significant breach only after giving the person an opportunity of being heard. Act s.33(1) 5. Question 5 of 5 ### Under Rule 19(9), within what period must a Board inquiry normally be completed? - Two years - 90 days - One year - Six months Show the answer **D. Six months** Rule 19(9) requires completion within six months of receiving the matter, extendable for reasons in writing by up to three months at a time. Rules r.19(9) Try again[Next lesson: Timelines and getting ready](https://foctta.com/learn/timelines-and-readiness) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) - [G.S.R. 844(E), 13 November 2025: establishment of the Data Protection Board of India](https://egazette.gov.in/WriteReadData/2025/267648.pdf) - [G.S.R. 845(E), 13 November 2025: the Board shall consist of four members](https://egazette.gov.in/WriteReadData/2025/267649.pdf) - [MeitY F. No. 2(1)/2026-Pers.I, 6 May 2026: appointment to the posts of Chairperson and Members, Data Protection Board of India](https://www.meity.gov.in/static/uploads/2026/05/cd481c027470b420b4cb85fb40a91c53.pdf) - [MeitY advertisement: filling up the posts of Chairman and Members in the Data Protection Board of India (2026)](https://www.meity.gov.in/static/uploads/2026/05/53b1bcf01cab9a0adde463e73fbc3417.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 10 **Sending data outside India**](https://foctta.com/learn/cross-border) [Lesson 12 → **Timelines and getting ready**](https://foctta.com/learn/timelines-and-readiness) **In this lesson** 1. Where things stand 2. The Board 3. A digital office 4. What the Board can act on 5. How an inquiry runs 6. Penalties 7. Settling and appealing 8. Key points 9. In practice 10. Quiz Take the quiz