The Data Protection Board of India

Knowledge Resources › The Data Protection Board of India

Last updated: 9 September 2026

The Data Protection Board of India is the body established under the Digital Personal Data Protection Act, 2023 to oversee the framework and enforce it. Its establishment was among the first provisions to take effect, on the notification of the DPDP Rules, 2025 (13 November 2025). It is designed to operate as a digital-first body.

What the Board does

• inquires into personal data breaches and into complaints made by individuals;
• directs remedial or mitigation measures where a breach has occurred;
• imposes financial penalties for non-compliance after giving the person concerned an opportunity to be heard; and
• performs the other functions assigned to it under the Act.

Making a complaint

The Board is intended to function digitally: individuals are to be able to file complaints and follow their progress online, through a dedicated portal and app, without needing to appear in person. This is aimed at making grievance redressal simpler and quicker.

Penalties

The Act sets out the maximum financial penalties the Board may impose. The highest — up to ₹250 crore — applies to a failure to take reasonable security safeguards. Failure to notify a personal data breach, and breaches of the obligations relating to children, can each attract up to ₹200 crore. Other contraventions may attract up to ₹50 crore. The actual amount in any case is determined by the Board, having regard to the factors set out in the Act.

Appeals

A person aggrieved by a decision of the Board may appeal to the Appellate Tribunal — the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

This page is for general information only and is not legal advice. For the surrounding vocabulary, see Key Definitions Under the DPDP Act; for how the framework comes into force, see the phased implementation timeline.