What is the Data Protection Board of India?

What the Law Says

The Digital Personal Data Protection Act, 2023 creates the Data Protection Board of India as an independent adjudicatory body with specific powers to enforce data protection obligations.

The DPBI is constituted by the Central Government under Section 18 of the Digital Personal Data Protection Act, 2023. It functions as a tribunal-like body to handle complaints, investigate breaches, and impose penalties on data fiduciaries who fail to comply with the Act’s requirements.

The Board has the power to inquire into data breaches, direct remedial actions, and levy penalties up to ₹250 crore — the highest quantum prescribed under the Act. Its orders are binding and may be appealed before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), as specified in Section 52.

Members of the Board—including the Chairperson—are appointed by the Central Government based on expertise in data protection, law, cybersecurity, or administration. The Board operates independently but must follow principles of natural justice and transparency.

Statutory Text

The Central Government shall, by notification, constitute a Board to be called the Data Protection Board of India.

— Digital Personal Data Protection Act, 2023, s. 18(1) — Constitution of the Data Protection Board of India

Statutory Text

The Board may, after inquiry, impose a penalty… which may extend to two hundred and fifty crore rupees.

— Digital Personal Data Protection Act, 2023, s. 33(1) — Penalty for failure to prevent data breach

Statutory Text

Any person aggrieved by an order of the Board… may file an appeal before the Telecom Disputes Settlement and Appellate Tribunal.

— Digital Personal Data Protection Act, 2023, s. 52(1) — Appeal

Sources