Data Protection Board Orders
What to Expect & How to Prepare
Data Protection Board of India penalty orders will reshape corporate data governance when enforcement begins. The DPBI, constituted under Section 18 of the DPDP Act 2023, has the power to impose penalties up to Rs.250 crore per contravention — with no aggregate cap. Understanding how the Board will operate, what its first enforcement priorities will be, and how to mount a defence is essential for every Data Fiduciary processing personal data in India.
This analysis examines the DPBI adjudication procedure, expected first enforcement targets, penalty determination factors, defence strategies, and lessons from global data protection authorities. By Advocate Subodh Bajpai.
Table of Contents
- The Data Protection Board — Structure and Powers
- Adjudication Procedure — How Proceedings Will Work
- Expected First Enforcement Targets
- Penalty Framework — Section 33 and the Schedule
- Lessons from Global Data Protection Authorities
- Defence Strategy and Penalty Mitigation
- How to Prepare Before the First Orders
- FAQs — Data Protection Board Proceedings
The Data Protection Board — Structure and Powers
The Data Protection Board of India is constituted under Section 18 of the DPDP Act 2023 as an independent adjudicatory body. The Board consists of a Chairperson and Members appointed by the Central Government, with qualifications, terms, and conditions prescribed by the government. The Board is designed to function as a digital office — Section 28 mandates that proceedings be conducted digitally by default, a departure from traditional tribunal practice that signals faster resolution timelines.
The Board’s powers under Section 25 include: determining whether a Data Fiduciary has contravened the Act, imposing penalties under Section 33, directing a Data Fiduciary to take remedial action, accepting voluntary undertakings, and referring matters for further inquiry. The Board is not bound by the Code of Civil Procedure — it follows principles of natural justice, which require notice, opportunity to be heard, and a reasoned order. The Board can also take suo motu cognizance of contraventions, which means it does not need to wait for a complaint to initiate proceedings.
Unlike GDPR’s supervisory authorities, the DPBI does not have investigative powers in the traditional sense — there is no provision for dawn raids or compulsory inspections of premises. However, the Board can require any Data Fiduciary to furnish information, produce documents, and provide access to computer systems for examination. Non-compliance with the Board’s information requests itself constitutes a contravention. The practical effect is that while the Board cannot physically raid offices, its information-gathering powers are comprehensive.
Adjudication Procedure — How Proceedings Will Work
Complaint or Suo Motu Cognizance
Proceedings begin when a Data Principal files a complaint (after exhausting the Data Fiduciary’s grievance mechanism under Section 13) or when the Board takes suo motu cognizance based on media reports, referrals from sectoral regulators, or its own monitoring. The complaint must be in prescribed form. The Board will likely establish an online complaint portal — consistent with its digital office mandate.
Notice to Data Fiduciary
The Board issues a show-cause notice to the Data Fiduciary, specifying the alleged contravention and the evidence or information the Board relies on. The Data Fiduciary must be given a reasonable opportunity to respond. The notice will specify a timeline for response — likely 30 days, consistent with administrative law practice. The response must address each allegation specifically.
Digital Hearing and Evidence
The Board examines the complaint, response, and evidence. Proceedings are digital by default. The Board may call for additional information from either party, examine witnesses, or commission expert reports. There is no provision for discovery in the civil litigation sense, but the Board’s power to call for information effectively achieves a similar result. The Data Fiduciary has the right to present its case, including technical evidence on security measures, consent mechanisms, and compliance efforts.
Order — Directions and Penalty
The Board passes a reasoned order. If the contravention is established, the Board may: impose a penalty (up to the maximum prescribed for that category of contravention), direct the Data Fiduciary to take specific remedial action, or accept a voluntary undertaking from the Data Fiduciary. The order must set out the findings of fact, the legal analysis, and the reasoning for the penalty amount. The order is digitally signed and served on the parties.
Appeal to TDSAT
The aggrieved party (either the Data Fiduciary or the complainant) may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days of the Board’s order. The Appellate Tribunal conducts a full merits review — it can confirm, modify, or set aside the Board’s order. Further appeal lies to the Supreme Court, but only on questions of law. Pending appeal, the Board’s order remains enforceable unless the Appellate Tribunal grants a stay.
Expected First Enforcement Targets
Global data protection authorities follow a predictable pattern in their first enforcement years: they target cases that are high-visibility, legally straightforward, and send a clear deterrence signal. The Irish DPC targeted Meta; the French CNIL targeted Google; the Italian Garante targeted Clearview AI. The DPBI will follow a similar logic.
The most likely first targets are large-scale data breaches that have already occurred and been publicly reported. India has seen significant data breach incidents involving fintech platforms, healthcare databases, and government portals. These cases are factually clear (the breach occurred), the harm is demonstrable (millions of Data Principals affected), and the legal analysis is straightforward (failure to implement reasonable security measures under Section 8). The Board can initiate proceedings suo motu on these matters without waiting for individual complaints.
The second category of early targets is consent violations by large technology platforms. Pre-DPDP consent mechanisms — generic checkboxes, bundled consent, no withdrawal option — are clearly non-compliant. The Board may target a prominent platform to establish consent standards through an early order. Social media platforms and e-commerce marketplaces are likely candidates because their consent practices are visible, affect millions, and are readily auditable.
The third category is data breach notification failures. Section 8(6) requires Data Fiduciaries to notify the Board and affected Data Principals of personal data breaches. Companies that suffer breaches and attempt to conceal them — or delay notification — are likely early enforcement targets. The Board will want to establish that breach notification obligations are strictly enforced from the outset.
Companies that proactively engage with compliance — appointing DPOs, conducting data audits, upgrading consent mechanisms, and building breach response capabilities — are significantly less likely to be early enforcement targets. The Board will prioritise entities that have made no compliance effort over those that have demonstrated good faith efforts with incomplete implementation.
Penalty Framework — Section 33 and the Schedule
Critically, these are per-contravention penalties with no aggregate cap. A single incident can trigger multiple contraventions. A data breach caused by inadequate security (Rs.250 crore), combined with delayed breach notification (Rs.200 crore), affecting children’s data (Rs.200 crore), where the entity is an SDF that had not appointed a DPO (Rs.150 crore), could theoretically attract penalties exceeding Rs.800 crore. While the Board will exercise proportionality, the theoretical exposure is unprecedented in Indian regulatory enforcement.
Lessons from Global Data Protection Authorities
The first three years of GDPR enforcement (2018-2021) provide the clearest roadmap for predicting DPBI behaviour. EU supervisory authorities initially focused on high-profile, clear-cut cases: consent violations by tech giants, data breach notification failures, and basic compliance gaps. The Irish DPC fined WhatsApp EUR 225 million for transparency failures. The French CNIL fined Google EUR 150 million for cookie consent violations. The pattern: authorities targeted visible, systemic non-compliance rather than marginal violations.
A critical lesson from GDPR enforcement is the importance of cooperation during investigations. Entities that cooperated fully with supervisory authorities — providing information promptly, engaging constructively, and taking voluntary remedial action — consistently received lower penalties than those that obstructed or delayed proceedings. The DPBI is likely to follow the same approach: cooperation will be rewarded, and obstruction will be treated as an aggravating factor.
Another pattern: early GDPR enforcement focused on establishing legal precedent on key compliance questions. The first orders interpreted consent requirements, defined adequate security measures, and set breach notification expectations. DPBI first orders will similarly establish the Indian interpretation of DPDP provisions — making them precedent-setting for all subsequent enforcement. Companies named in first orders bear the additional reputational burden of being the test cases that define compliance standards for the entire market.
Defence Strategy and Penalty Mitigation
Pre-Proceeding: Build the Compliance Record
The most effective defence begins before any proceeding is initiated. Document every compliance measure: data protection policies, consent mechanism design, security audit reports, breach response plans, DPO appointment, training records, and DPIA reports. This compliance record becomes the primary evidence of good faith if proceedings are initiated. Companies with documented compliance efforts have the strongest penalty mitigation arguments.
Show-Cause Stage: Engage Fully and Early
When a show-cause notice arrives, engage immediately with specialised data protection counsel. The response must address every allegation factually and legally. Avoid generic denials. If a contravention occurred, acknowledge it while presenting the context: what security measures were in place, what remedial action was taken, how many Data Principals were affected, and what steps have been taken to prevent recurrence. Early engagement signals cooperation.
Penalty Mitigation: Proportionality Arguments
The Board must apply principles of proportionality in penalty determination. Key mitigation arguments: the contravention was negligent, not intentional; remedial action was taken promptly; the entity cooperated fully with the Board; the entity has invested substantially in compliance infrastructure; the impact on Data Principals was contained; and the entity is a first-time offender. Each mitigation argument should be supported with documented evidence.
Voluntary Undertakings: Settle Before Order
Section 25 allows the Board to accept voluntary undertakings from Data Fiduciaries. If the Board agrees to accept an undertaking — committing to specific remedial actions within a defined timeline — the proceeding may be resolved without a formal penalty order. This is equivalent to a consent order in securities enforcement. Companies facing clear contraventions should consider approaching the Board proactively with a voluntary undertaking proposal. Early engagement before formal proceedings creates the best conditions for this approach.
How to Prepare Before the First Orders
The window between now and the DPBI’s first penalty orders is the preparation window. Every Data Fiduciary should use this period to build the compliance infrastructure and documentation that will serve as both a compliance shield and a penalty mitigation tool. The preparation checklist includes:
Conduct a comprehensive data inventory mapping all personal data processing activities, data flows, lawful bases, and retention periods. Upgrade consent mechanisms to meet the five-element test (free, specific, informed, unconditional, unambiguous). Implement breach detection and notification infrastructure — the 72-hour breach notification window (expected in rules) requires automated detection. Appoint a DPO or DPO-designate and build the data protection governance function. Engage independent data auditors for a baseline compliance assessment. Establish board-level reporting on data protection compliance. Train all employees who handle personal data. Document everything — the compliance record is your primary defence asset.
Companies that complete this preparation before enforcement begins will be positioned to respond to any DPBI inquiry from a position of demonstrated compliance. Companies that wait until a show-cause notice arrives to begin compliance will face a significantly harder defence with significantly higher penalty exposure.
FAQs — Data Protection Board Proceedings
When will the Data Protection Board start issuing penalty orders?
What is the maximum penalty the Data Protection Board can impose?
Can the Data Protection Board impose penalties on government bodies?
Is there an appeal mechanism against Data Protection Board orders?
How will the DPBI proceedings differ from civil court proceedings?
What factors will the Board consider when determining penalty amounts?
Can individuals file complaints directly with the Data Protection Board?
Build Your DPBI Defence Before Enforcement Begins
Unified Chambers advises corporates on DPDP enforcement readiness — compliance audits, breach response protocols, and defence strategy. Advocate Subodh Bajpai available directly.