Data Protection Board of India

The Data Protection Board of India (DPBI) is established under Section 18 of the DPDPA as an independent adjudicatory body. It is the central institution for enforcement of the Act, responsible for receiving complaints, conducting inquiries, imposing penalties, and issuing directions for remedial action. The Board functions as a digital office and conducts proceedings in a technology-driven manner. This digital-first approach is intended to ensure efficiency, transparency, and accessibility across India.

The Board comprises a Chairperson and members appointed by the Central Government. Rules 17-18 of the DPDP Rules prescribe the qualifications, selection process, tenure, and conditions of service. Under section 26(c) of the Act, the Board may allocate its proceedings to a Member or to groups of Members, and its composition may be expanded as the volume of proceedings requires. The independence of the Board is a critical factor in its effectiveness. The appointment process, fixed tenure, and removal protections are designed to insulate the Board from political interference.

The Board has extensive powers including: (a) receiving and adjudicating complaints from Data Principals; (b) initiating suo motu inquiries; (c) summoning and examining persons; (d) requiring production of documents; (e) receiving evidence on affidavit; (f) requisitioning public records; (g) imposing penalties up to Rs 250 crore; and (h) issuing directions for remedial action. The Board is not bound by the Code of Civil Procedure but must follow principles of natural justice. This provides procedural flexibility while ensuring fairness.

Rules 17-21 establish the procedural framework for Board proceedings. Complaints must be submitted in the prescribed form and manner. The Board conducts inquiries, provides opportunity to be heard, examines evidence, and issues reasoned orders. Proceedings are conducted digitally, and the Board may use video conferencing and electronic communication. Orders are published and serve as precedent for future cases.

The Board's decisions will shape the interpretation and enforcement of the DPDPA. Early decisions on key issues - such as the adequacy of consent mechanisms, the scope of legitimate uses, and proportionality of penalties - will provide critical guidance to organisations. Organisations should monitor Board decisions, maintain compliance documentation that can withstand Board scrutiny, and establish internal processes for responding to Board inquiries promptly.