IndiaHow do I file a complaint about data misuse?
You can file a complaint about data misuse in India under the Digital Personal Data Protection Act, 2023, by submitting it to the Data Protection Board of India (DPBI) — either online or in writing — within 30 days of becoming aware of the breach.
What the Law Says
The Digital Personal Data Protection Act, 2023 (DPDP Act) sets out the legal framework for filing complaints about data misuse by data fiduciaries in India.
Under Section 24 of the DPDP Act, any individual (data principal) who believes their personal data has been processed in violation of the Act may file a complaint with the Data Protection Board of India (DPBI).
The complaint must be filed within 30 days of the data principal becoming aware of the alleged violation. A fee of ₹250 is prescribed for filing the complaint, unless waived in cases of financial hardship.
The DPBI is empowered to investigate, summon parties, issue directions, and impose penalties — including fines up to ₹250 crore — for serious breaches.
Statutory TextAny data principal may, on the occurrence of a grievance, make a complaint to the Board in such manner and form as may be specified by regulations.
— Digital Personal Data Protection Act, 2023, s. 24 — Filing of complaint by data principal
Statutory TextThe Board may, after giving an opportunity of being heard to the parties concerned, pass such orders as it deems fit, including directing the data fiduciary to cease processing, pay compensation, or take corrective measures.
— Digital Personal Data Protection Act, 2023, s. 24(4) — Powers of the Board
What to Do
Step 1: Gather evidence — screenshots, messages, consent records, or breach notifications related to the misuse.
Step 2: Draft your complaint clearly stating facts, sections violated (e.g., s. 8 on consent, s. 9 on purpose limitation), and relief sought.
Step 3: Submit the complaint online via the DPBI portal (https://dpbi.gov.in) or by post with ₹250 fee (or application for waiver).
Step 4: Await acknowledgment (within 7 days) and participate in hearings if summoned by the DPBI.
Step 5: If dissatisfied with DPBI’s order, appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 45 days.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.