Module 5 of 6 — DPDP Act 2023 Compliance

Data Protection Board: Enforcement and Penalties

Reading module · approx 12 min

The Data Protection Board of India (DPB) is the adjudicatory body established under the DPDP Act to investigate data protection violations and impose penalties. Understanding how the Board operates, what triggers an investigation, and what the penalty exposure is should inform every compliance risk assessment.

Constitution and powers of the Board

The Board is a digital office — it operates online, without requiring physical appearances in most cases. It consists of a Chairperson and other members appointed by the central government. The Board has the power to: take cognisance of personal data breaches reported by Data Fiduciaries; investigate complaints filed by Data Principals; inquire into violations of the Act; impose financial penalties; and direct remediation.

Breach notification obligations

A Data Fiduciary must notify the Board of a personal data breach in the prescribed form and manner. The DPDP Rules will specify the timeline for notification (expected to be within 72 hours, similar to GDPR, though the Rules may vary). The notification must contain: the nature of the breach; the categories and approximate number of Data Principals affected; the likely consequences of the breach; and the measures taken or proposed to address it.

Penalty structure

The DPDP Act prescribes a tiered penalty structure based on the category of violation:

Up to Rs. 250 crore: breach of duty to implement security safeguards
Up to Rs. 200 crore: failure to notify the Board or Data Principals of a breach
Up to Rs. 200 crore: breach of obligations related to children's data
Up to Rs. 150 crore: breach of obligations of Significant Data Fiduciaries
Up to Rs. 10,000 crore: the maximum aggregate penalty for multiple violations across the categories above — making this one of the highest regulatory penalty caps in Indian law

No criminal liability The DPDP Act imposes civil penalties only — unlike GDPR, which permits criminal liability in some EU member states for certain violations. The Act also does not provide for private rights of action: Data Principals cannot sue Data Fiduciaries directly for compensation. Their remedies are to file complaints with the Board and exercise their rights through the Fiduciary's grievance mechanism.

Enforcement process

The Board investigates following either a Data Principal complaint or a reference from the central government. The process is designed to be digital and time-bound. The Board may call for documents, issue notices, and conduct hearings online. Parties are entitled to be heard before a penalty is imposed. Appeals against Board orders lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), and thereafter to the High Court and Supreme Court.

Module 6 covers Significant Data Fiduciaries specifically, and what a practical DPDP compliance programme looks like for a typical Indian business.