The DPDP Act is enforced by a new regulator: the Data Protection Board of India. Understanding how it works — and how a complaint reaches it — tells you what compliance really has to withstand.
What the Board is
The Board is an independent body set up under the Act to enforce it. It is designed to function as a digital office — complaints, proceedings and decisions handled largely online — and its constitution was among the first provisions brought into force when the DPDP Rules, 2025 were notified in November 2025.
What the Board can do
- Inquire into personal data breaches and complaints, on reference or on its own.
- Direct urgent remedial or mitigation measures during a breach.
- Impose monetary penalties under the Schedule — up to ₹250 crore for failing to prevent a breach, with other caps for other failures.
- Accept voluntary undertakings — a party can commit to fix things, which can close an inquiry.
How a complaint flows
- Exhaust the business's grievance channel first. A Data Principal must use your grievance-redressal mechanism before going to the Board.
- Complain to the Board if unresolved.
- Inquiry — the Board examines the matter, giving the business a chance to be heard.
- Decision — directions and/or a penalty, with written reasons.
How penalties are decided
The Board weighs the nature, gravity and duration of the breach, the type of data, whether it was repetitive, any gains made, and what the business did to mitigate. This is exactly why a documented, prompt response — and evidence of reasonable safeguards — directly lowers exposure.
Appeals
A party aggrieved by the Board's order can appeal to the Appellate Tribunal (the TDSAT), and onward on points of law. The process is meant to be digital and time-bound.
What this means for you
You cannot argue your way past missing safeguards after the fact. The Board rewards organisations that can show their notices, consent records, security and breach response — and penalises those who cannot.
How DPDP Bridge helps
DPDP Bridge gives you lawyer-led, software-driven DPDP compliance — notices and consent, data-principal rights, breach response, vendor contracts and audit-ready records in one place. Take the free assessment to see exactly where your organisation stands and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.