Procedural Framework for the Board (R.16-22)

Rule 16 ensures that certain processing activities do not trigger the standard complaint and penalty process before the Board. • Purpose: Processing for research, archival, or statistical purposes is exempt from most obligations, provided it is not used to take any decision specific to a Data Principal. • Criteria: The processing must be carried out in accordance with the Second Schedule of the Rules, which prescribes anonymisation or minimalisation and other technical and organisational standards. • Safeguards: Data Fiduciaries must still maintain reasonable security safeguards even under this exemption. See Research Exemption (R.16) for a full breakdown.

Rule 17 establishes the framework for the Data Protection Board of India's composition and appointment: - The Board consists of a Chairperson and Members appointed by the Central Government - Members are selected based on demonstrated expertise in data protection, information technology, law, or related fields - The Board functions as a 'digital office' - operating primarily through digital means - This technology-driven approach aligns with the Act's focus on digital personal data

Rule 18 prescribes the salary, allowances, and other terms and conditions of service of the Chairperson and Members of the Data Protection Board: - Salary, allowances, and tenure are determined by the Central Government at the time of appointment - Terms of service, including conditions relating to removal, are governed by this Rule - These provisions are intended to insulate remuneration and service conditions from ad hoc executive interference during a Member's term The Board's substantive powers and functions, including adjudication of complaints and imposition of penalties as provided under the Schedule, derive from the Act itself (notably Sections 27 and 28) rather than from this Rule.

Rule 19 governs the Board's internal functioning: - The procedure for convening and conducting meetings of the Board - Quorum requirements for valid proceedings - The manner of authentication of orders, directions, and instruments issued by the Board, including where these are issued digitally These are internal procedural provisions. The Board's inquiry and adjudication process itself, including notice to the Data Fiduciary and consideration of evidence, is governed by Sections 27 and 28 of the Act.

Rule 20 confirms that the Board functions as a digital office: - Complaints, references, and applications are received electronically - Proceedings, hearings, and communications are conducted through digital means to the extent practicable - Orders and notices may be authenticated and served electronically This digital-first architecture reflects the Act's broader focus on digital personal data and is intended to make the Board accessible without requiring physical filing or attendance.

Rule 21 empowers the Board to appoint officers and employees necessary to discharge its functions and prescribes their terms of appointment. It is a staffing and administrative provision and does not itself concern how appeals against Board orders are made. The right to appeal a Board order lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) under Section 29 of the DPDPA, with a further appeal on questions of law to the Supreme Court of India.

Section 29(2) of the DPDPA fixes the limitation period for an appeal against a Board order at sixty days from the date the order is received, with TDSAT empowered to condone the delay on sufficient cause. Rule 22 supplements this by prescribing only the procedural mechanics of filing: • Format: Appeals must be submitted in the prescribed digital format. • Fee: The appeal must be accompanied by a fee equivalent to the fee prescribed under the TRAI Act, 1997 for a similar proceeding. Rule 22 does not itself set any limitation period; the sixty-day time limit comes from Section 29(2) of the Act. This aligns with the broader DPDP (Appellate Tribunal) Rules notified in 2025, which supplement the general TDSAT procedures under the TRAI Act.