Data Protection Board of India

DPDP Act 2023 — Sections 18-26

The Data Protection Board of India (DPBI) is the adjudicatory body established under Chapter IV (Sections 18-26) of the DPDP Act 2023. It receives and adjudicates complaints from data principals against data fiduciaries, conducts inquiries, and imposes monetary penalties up to Rs 250 crore per contravention. The Board is a digital-by-default office with online proceedings. Its orders are enforceable as decrees of a civil court. Appeals against DPBI orders lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) and thereafter to the Supreme Court.

The Data Protection Board of India, constituted under Chapter IV (Sections 18-26) of the DPDP Act 2023, is where data disputes are actually decided. It receives complaints from data principals, inquires into alleged contraventions, and can impose substantial monetary penalties per contravention. Because it operates as a digital-by-default office, proceedings are largely online, which changes how counsel prepares and files. Its orders carry the force of a civil court decree, so an adverse finding is directly enforceable, and appeals lie to the TDSAT and onward to the Supreme Court. For a bank or NBFC, this means a borrower's data grievance can escalate into a formal adjudication with real financial consequences, parallel to any recovery litigation. Counsel must treat a Board notice with the seriousness of court process — preserving records, responding within timelines, and building the compliance narrative early. Getting the response wrong, or treating the Board as a soft forum, risks penalty and an enforceable order. Well-advised institutions engage with Board proceedings promptly.