Adjudication Process

The adjudication process begins when a Data Principal files a complaint with the Data Protection Board, or when the Board initiates proceedings suo motu based on a reference from the Central or State Government. The complaint must be filed after the internal grievance redressal process with the Data Fiduciary has been exhausted or the prescribed timeline has lapsed. Complaints are submitted digitally through the Board's portal in the prescribed form and manner.

Upon receiving a complaint, the Board conducts an inquiry into the alleged non-compliance. The inquiry follows principles of natural justice - both parties are given an opportunity to be heard. The Board may call for information, examine evidence, and hear witnesses. The Board operates through Benches and may assign specific matters to specific Benches based on the subject matter or volume of cases. Proceedings are conducted digitally using technology-driven processes.

Upon completing the inquiry, the Board determines whether a breach of the Act has occurred. If non-compliance is established, the Board may: (a) impose financial penalties as prescribed in the Schedule; (b) issue directions for remedial action; (c) direct the Data Fiduciary to cease specific processing activities; and (d) direct the Data Fiduciary to take specific steps to comply with the Act. All orders must be reasoned and are published for public access.

The Board considers several factors when determining the quantum of penalty: (a) the nature, gravity, and duration of the non-compliance; (b) the type and nature of personal data affected; (c) the repetitive nature of the default; (d) whether the Data Fiduciary derived any gain from the non-compliance; and (e) whether the Data Fiduciary took prompt remedial action. Penalties are civil in nature and are not criminal sanctions. The maximum penalty of Rs 250 crore applies to the most serious breaches.

Board orders are binding and enforceable. Non-compliance with Board directions may result in additional proceedings and penalties. The Board's digital-first approach ensures that orders are communicated promptly and records are maintained electronically. Organisations should establish internal protocols for responding to Board inquiries, including designating responsible persons, preserving relevant evidence, and engaging legal counsel.