Most businesses will never want to meet the Data Protection Board in enforcement mode — but knowing how an inquiry works, and preparing for it, is part of good compliance. Here's what to expect.
How an inquiry starts
The Board can inquire into a complaint (usually after the person has used your grievance channel) or a reported breach. It functions largely as a digital office, so expect online proceedings.
What the Board can do
It can seek information, direct urgent remedial measures during a breach, and impose penalties under the Schedule. It can also accept a voluntary undertaking to fix things.
What to do
- Respond promptly and accurately — cooperate; don't obstruct.
- Produce your records — consent, notices, security, breach timeline (this is where recordkeeping pays off).
- Show remediation — what you've fixed and how.
- Take advice — get legal input early.
How penalties are weighed
The Board considers the nature, gravity and duration of the breach, whether it was repetitive, and your response. Prompt, documented action directly reduces exposure. Orders can be appealed to the Appellate Tribunal.
How DPDP Bridge helps
DPDP Bridge keeps you inquiry-ready — the records, breach timeline and remediation evidence that make a Board inquiry survivable. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.