top of page
Search

How to Prepare for an Inquiry by the Data Protection Board Under the DPDP Act

Writer: Kaustav Chowdhury
Kaustav Chowdhury
Oct 12
7 min read

Updated: 12 hours ago

An inquiry by the Data Protection Board is the stage most compliance programmes never plan for. Section 27 of the Digital Personal Data Protection Act, 2023 gives the Board its powers, section 28 sets out the procedure it must follow, and rule 19 of the Digital Personal Data Protection Rules, 2025 puts a six month clock on the inquiry. The asymmetry matters: the procedural rules came into force on publication, while the powers they govern are not yet operative.

Step 1: Fix What Is in Force, and What Is Not

Rule 1(2) of the Rules provides that rules 1, 2 and 17 to 21 come into force on the date of their publication in the Official Gazette. Rule 19 and rule 20, the Board's meeting procedure and its functioning as a digital office, sit in that group. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication.

On the Act's side, the commencement notification G.S.R. 843(E) dated November 13, 2025 brought sections 18 to 26 into force at once, so the Board's establishment and constitution are operative. Section 27 apart from clause (d) of sub-section (1), and sections 28 to 34, come into force eighteen months after publication, which falls in May 2027, while section 27(1)(d) commences at the one year point in November 2026.

Step 2: Know the Five Ways an Inquiry Can Begin

Section 27(1) lists what the Board may act on. Clause (a) covers an intimation of a personal data breach, where the Board may direct urgent remedial or mitigation measures, inquire into the breach and impose a penalty. Clause (b) covers a complaint by a data principal about a breach or a violation of her rights, a reference by the Central Government or a State Government, and a direction of a court.

Clause (c) covers a complaint about a Consent Manager's breach of its obligations, clause (d) an intimation of a breach of a condition of a Consent Manager's registration, and clause (e) a reference by the Central Government in relation to an intermediary. Clause (d) is the one to diarise early, because it commences a year ahead of the rest.

Step 3: Treat the Sufficient Grounds Question as the Real Hearing

Section 28(3) requires the Board, on receipt of an intimation, complaint, reference or direction, to determine whether there are sufficient grounds to proceed with an inquiry. Section 28(4) allows it to close the proceedings where it determines that there are insufficient grounds, recording its reasons in writing.

That is the cheapest exit the procedure offers, and it is lost by treating the opening communication as a formality. Build the first written submission to the sufficient grounds question and nothing else: what the complaint alleges, what the record shows, and why no inquiry is warranted. The merits belong to an inquiry actually ordered.

Step 4: Diarise the Six Month Clock, and Read the Extension Carefully

Rule 19(9) provides that the inquiry by the Board shall be completed within a period of six months from the date of receipt of the intimation, complaint, reference or direction under section 27 of the Act, unless such period is extended by it, for reasons to be recorded in writing, for a further period not exceeding three months at a time.

Two points follow for the file. The period runs from receipt rather than from the day the Board decides to inquire, so time is already running while the sufficient grounds question is open. And the rule caps the length of each extension rather than the number of them, and attaches no consequence to an overrun, so it disciplines the Board rather than giving a respondent something to hold it to.

Step 5: Prepare for a Digital Office, Not a Courtroom

Section 28(1) requires the Board to function as an independent body and, as far as practicable, as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions being digital by design, and to adopt such techno-legal measures as may be prescribed. Rule 20 is that prescription. The Board shall function as a digital office and, without prejudice to its power to summon and enforce the attendance of any person and examine her on oath, may adopt techno-legal measures to conduct proceedings in a manner that does not require physical presence of any individual.

So the summons survives the screen. A person can be required to attend and be examined on oath without anyone travelling, which moves the preparation forward rather than removing it. Make sure the documents can be produced in usable digital form, and identify in advance who will speak to them.

Step 6: Know the Board's Civil Court Powers and Their Limits

Section 28(7) gives the Board, for the discharge of its functions, the same powers as are vested in a civil court in respect of specified matters: summoning and enforcing attendance and examining a person on oath, receiving evidence on affidavit and requiring the discovery and production of documents, inspecting data, books, documents and registers, and such other matters as may be prescribed.

Section 28(8) is the limit that matters commercially. The Board is not to prevent access to any premises, or take away any equipment, in a manner that may adversely affect the day to day functioning of a person. Section 28(9) allows it to require the services of a police officer or any officer of government, and section 28(10) allows an interim order during an inquiry after the affected person has been heard.

Step 7: Understand the Two Exits and the Costs Risk

Section 28(6) requires an inquiry to follow the principles of natural justice and the Board to record its reasons. Section 28(11) then provides the two outcomes: on conclusion of the inquiry, and after giving the person an opportunity of being heard, the Board may either close the proceedings or proceed to impose a penalty under section 33, recording its reasons in writing.

Section 28(12) deserves its own paragraph when the client is the complainant. At any stage, if the Board concludes that a complaint is false or frivolous, it may warn the complainant or impose costs. A data principal who wants to complain should be told that the complaint carries exposure of its own, and the file should record on what material the allegation was made.

Common Pitfalls to Avoid

  • Treating the inquiry power as available today: Section 27 apart from clause (1)(d), and sections 28 to 34, commence with the eighteen month tranche.

  • Assuming the procedure commences with the powers: Rules 1, 2 and 17 to 21 came into force on publication, so rule 19 and rule 20 are operative ahead of the provisions they serve.

  • Missing that one limb commences early: Section 27(1)(d), on a breach of a Consent Manager's registration conditions, commences at the one year point.

  • Measuring six months from the start of the inquiry: Rule 19(9) measures from the date of receipt.

  • Reading the extension as a single one: The cap in rule 19(9) is three months at a time, not three months in total.

  • Expecting a hearing in a room: Rule 20 lets the Board proceed without the physical presence of any individual, while keeping its power to summon and examine on oath.

  • Advising a complaint without the costs risk: Section 28(12) allows the Board to warn a complainant or impose costs for a false or frivolous complaint.

Key Statutory Provisions

  • Section 27 of the Digital Personal Data Protection Act, 2023: The powers and functions of the Board, exercised on an intimation of a personal data breach, on a complaint by a data principal or a reference by government or a direction of a court, on matters concerning a Consent Manager, and on a reference about an intermediary, with the power to issue directions after a hearing.

  • Section 28 of the Act: The Board as an independent body functioning as far as practicable as a digital office; sufficient grounds to proceed and closure for insufficient grounds; inquiry in accordance with natural justice; the powers of a civil court in respect of specified matters; the bar on action that adversely affects day to day functioning; interim orders after a hearing; the two outcomes on conclusion of an inquiry; and costs for a false or frivolous complaint.

  • Section 33 of the Act: The penalty route an inquiry may lead to, available only where the Board determines on conclusion of the inquiry that the breach is significant and after giving the person an opportunity of being heard.

  • Rule 19 of the Digital Personal Data Protection Rules, 2025: The procedure for meetings of the Board and the authentication of its orders, directions and instruments, including the quorum of one third of the membership and the casting vote, and the six month period for completing an inquiry with extensions not exceeding three months at a time.

  • Rule 20 of the Rules: The Board functions as a digital office and may adopt techno-legal measures to conduct proceedings in a manner that does not require physical presence of any individual, without prejudice to its power to summon and examine on oath.

Related in This Series

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page