Procedural Framework for the Board (R.16-22)

Rule 16 ensures that certain processing activities do not trigger the standard complaint and penalty process before the Board. • Purpose: Processing for research, archival, or statistical purposes is exempt from most obligations, provided it is not used to take any decision specific to a Data Principal. • Criteria: The processing must be carried out in accordance with the Second Schedule of the Rules, which prescribes anonymisation or minimalisation and other technical and organisational standards. • Safeguards: Data Fiduciaries must still maintain reasonable security safeguards even under this exemption. See Research Exemption (R.16) for a full breakdown.

Rule 17 establishes the framework for the Data Protection Board of India's composition and appointment: - The Board consists of a Chairperson and Members appointed by the Central Government - Members are selected based on demonstrated expertise in data protection, information technology, law, or related fields - The Board functions as a 'digital office' - operating primarily through digital means - This technology-driven approach aligns with the Act's focus on digital personal data

Rule 18 defines the Board's powers and functions: - Adjudication of complaints filed by Data Principals against Data Fiduciaries - Initiation of suo motu inquiries where the Board has reason to believe a violation has occurred - Imposition of penalties as provided under the Schedule to the Act - Directing Data Fiduciaries to take specific remedial measures - Registration and oversight of Consent Managers - Power to call for information and records from Data Fiduciaries - Coordination with sectoral regulators on data protection matters

Rule 19 establishes the inquiry and adjudication procedures: - Complaints may be filed by Data Principals through the Board's digital platform - The Board issues notices to the Data Fiduciary and provides opportunity to respond - Proceedings are conducted digitally to the extent possible - The Board may require parties to submit evidence, documents, and information - The Board may appoint technical experts to assist in complex matters - Decisions are based on the evidence and arguments presented by both parties

Rule 20 ensures principles of natural justice: - Right to be heard: Both parties must have adequate opportunity to present their case - Reasoned decisions: The Board must provide reasons for its decisions - Timeline for disposal: The Board should dispose of complaints within a reasonable timeline - No ex parte decisions without giving adequate opportunity to the affected party - Proceedings must be fair, transparent, and consistent These safeguards ensure that the Board's adjudication process is fair and aligns with constitutional principles.

Rule 21 establishes the appeal framework: - Appeals against Board decisions lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) - TDSAT exercises appellate jurisdiction over the Board's orders - Further appeals from TDSAT lie to the Supreme Court of India on questions of law (governed by Section 18 of the TRAI Act, 1997, made applicable via Section 29(9) of the DPDPA) - This three-tier adjudication structure (Board > TDSAT > Supreme Court) ensures comprehensive judicial review The use of TDSAT as the appellate body reflects the Government's decision to leverage existing institutional infrastructure rather than creating a new appellate body.

Rule 22 prescribes the procedural mechanics for filing an appeal before TDSAT: • Filing period: An appeal against a Board order must be filed with TDSAT within 60 days from the date the order is received. • Format: Appeals must be submitted in the prescribed digital format, accompanied by the specified fee. • Condonation of delay: The Tribunal may accept an appeal after 60 days only if it is satisfied there was 'sufficient cause' for the delay. This aligns with the broader DPDP (Appellate Tribunal) Rules notified in 2025, which supplement the general TDSAT procedures under the TRAI Act.