The Power and Adjudicatory Structure of the Data Protection Board of India (DPBI): Investigating Procedural 

The Power and Adjudicatory Structure of the Data Protection Board of India (DPBI): Investigating Procedural

Abstract

The Digital Personal Data Protection Act, 2023 (DPDP Act) marks a significant step in India’s journey towards protecting informational privacy in the digital age. At the heart of this framework lies the Data Protection Board of India (DPBI), the statutory body responsible for enforcing compliance, adjudicating disputes, and imposing penalties for violations of the Act. The effectiveness of the DPDP regime depends not only on the rights granted to individuals but also on the institutional strength and procedural fairness of the Board. This article examines the composition, powers, and adjudicatory framework of the DPBI while critically evaluating the procedural challenges that may affect its independence and efficiency.

1. Introduction

The rapid growth of digital services has transformed how personal data is collected, processed, and shared. From online banking and e-commerce to healthcare and social media, personal information has become a valuable digital asset. While this transformation has enhanced convenience and economic growth, it has also increased the risk of data breaches, identity theft, and misuse of personal information.

Recognising these concerns, Parliament enacted the Digital Personal Data Protection Act, 2023, providing India’s first comprehensive legal framework for regulating digital personal data. The Act grants rights to Data Principals, imposes obligations on Data Fiduciaries, and establishes the Data Protection Board of India (DPBI) as the principal enforcement authority.

The DPBI serves as the backbone of the enforcement mechanism. It investigates complaints, examines data breaches, issues directions, and imposes financial penalties where violations are established. Therefore, understanding its institutional structure is essential because the effectiveness of India’s privacy regime ultimately depends upon how fairly, independently, and efficiently the Board performs its adjudicatory functions.

2. Institutional Blueprint: Composition of the DPBI

The DPDP Act empowers the Central Government to establish the Data Protection Board of India through notification. The Board consists of a Chairperson and such number of Members as the Government considers necessary, allowing flexibility to expand its capacity with the increasing volume of digital disputes.

Appointments are made by the Central Government from individuals possessing expertise in law, information technology, cybersecurity, public administration, data governance, or related disciplines. Such multidisciplinary qualifications acknowledge that privacy disputes often involve both legal and technical issues.

The service conditions, tenure, salary, and other terms of appointment are prescribed by the Central Government. While this administrative flexibility may facilitate efficient governance, it has also generated debate regarding institutional independence. Since appointments and service conditions remain largely under executive control, concerns have been raised about whether the Board enjoys sufficient autonomy when dealing with matters involving governmental agencies.

Supporting the Board is a digital-first Secretariat, responsible for maintaining electronic records, receiving complaints, managing case files, facilitating communication with parties, and ensuring smooth digital administration. This structure reflects the Act’s objective of creating a technology-driven regulator capable of handling disputes through online platforms rather than conventional paper-based procedures.

3. Statutory Arsenal: Powers of the DPBI

The DPBI exercises significant statutory powers to ensure compliance with the DPDP Act.

For inquiry purposes, the Board enjoys powers similar to those of a civil court. It may summon individuals, require the production of documents, examine digital records, call for relevant information, and conduct inquiries necessary for determining whether statutory obligations have been violated. These powers enable the Board to investigate complex data breaches involving multiple stakeholders.

The Board also possesses substantial financial enforcement authority. Depending upon the nature and gravity of the violation, penalties may extend up to ₹250 crore for serious instances of non-compliance, including failure to implement reasonable security safeguards leading to personal data breaches. The objective is not merely punitive but also deterrent, encouraging organisations to adopt stronger privacy and cybersecurity practices.

Another important feature is the Board’s power to issue directions aimed at preventing continuing harm. Where ongoing processing of personal data creates significant risks, the DPBI may direct the concerned Data Fiduciary to take corrective measures, suspend specific processing activities, or comply with statutory obligations pending completion of the inquiry. Such preventive powers ensure that regulatory intervention is not delayed until irreversible damage has already occurred.

4. Investigation and Adjudication Procedure

The DPDP Act adopts a digital-by-design approach to dispute resolution, making the adjudicatory process faster and more accessible. Proceedings before the DPBI may commence through multiple channels. A complaint may be filed by an affected Data Principal after exhausting the grievance redressal mechanism of the Data Fiduciary. Proceedings may also begin when a Data Fiduciary reports a personal data breach, or when the Central Government refers a matter requiring investigation.

After receiving a complaint, the Board examines whether a prima facie case exists. If necessary, it may call for documents, seek explanations, or require additional information from the parties. Throughout the inquiry, electronic communication remains the primary mode of filing pleadings, submitting evidence, issuing notices, and delivering orders, thereby reducing procedural delays associated with traditional litigation.

Although the Board is not bound by the strict procedural requirements of the Code of Civil Procedure, 1908, it must adhere to the principles of natural justice. Both parties must receive adequate notice of the proceedings, an opportunity to present their case, and a fair hearing before any adverse order or monetary penalty is imposed. This procedural safeguard protects individuals and organisations from arbitrary administrative action while preserving the efficiency of the regulatory process.

The Act also permits the use of Alternative Dispute Resolution (ADR) where appropriate. By encouraging mediation or negotiated settlements in suitable cases, the Board can resolve disputes without prolonged adjudication, reducing litigation costs and improving regulatory efficiency.

5. Evaluating Procedural Bottlenecks and Challenges

Despite its progressive framework, the DPBI faces several institutional and procedural challenges.

The foremost concern relates to institutional independence. Since the Central Government plays a significant role in appointing members and determining their service conditions, questions have been raised regarding the Board’s autonomy, particularly when complaints involve public authorities. A stronger appointment mechanism with greater institutional safeguards could enhance public confidence in the Board’s impartiality.

A second challenge concerns capacity and workload. India has one of the world’s largest digital populations, with millions of users generating enormous volumes of personal data every day. As digital transactions continue to expand, the number of privacy complaints is expected to increase substantially. Without adequate staffing, technological infrastructure, and specialised expertise, the Board may face significant backlogs, reducing the effectiveness of the enforcement framework.

The digital-first model, while efficient, may also create barriers for individuals living in areas with limited internet access or inadequate digital literacy. Unless supported by accessible grievance facilitation centres and awareness programmes, exclusive reliance on digital procedures may unintentionally restrict access to justice for vulnerable sections of society.

The appellate mechanism under the Act provides an important safeguard against erroneous decisions. Any person aggrieved by an order of the DPBI may prefer an appeal before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within the prescribed period. Decisions of the Tribunal may thereafter be challenged before the Supreme Court on questions of law, thereby ensuring judicial oversight over the Board’s exercise of statutory powers.

6. Conclusion and Strategic Recommendations

The establishment of the Data Protection Board of India represents a significant milestone in India’s evolving privacy jurisprudence. By creating a specialised adjudicatory body with investigative, regulatory, and enforcement powers, the DPDP Act seeks to ensure that the right to data protection is supported by an effective institutional framework rather than remaining a mere statutory promise.

However, the long-term success of the Board will depend not only on the breadth of its legal powers but also on its institutional independence, administrative efficiency, and procedural fairness. As India’s digital ecosystem continues to expand, the DPBI must evolve into a technologically competent and publicly trusted regulator capable of balancing innovation with the constitutional value of privacy.

To strengthen the effectiveness of the Board, the following reforms deserve consideration:

• Introduce a more transparent and independent appointment process to reinforce institutional autonomy.
• Establish a dedicated financial allocation and increase technical manpower to prevent future case backlogs.
• Deploy artificial intelligence-based case management systems to prioritise urgent matters while preserving human oversight in adjudication.
• Expand digital literacy initiatives and provide assisted filing mechanisms to ensure equal access for citizens lacking technological resources.
• Publish periodic enforcement reports to enhance transparency, accountability, and public confidence in the functioning of the Board.

A robust adjudicatory mechanism is indispensable for meaningful privacy protection. The Data Protection Board of India possesses the statutory foundation to become an effective regulator; its future success will ultimately depend upon how efficiently it exercises its powers while upholding fairness, transparency, and constitutional values.

Frequently Asked Questions (FAQs)

Q1. What is the primary role of the Data Protection Board of India (DPBI)?

Answer:

The Data Protection Board of India (DPBI) is the statutory authority established under the Digital Personal Data Protection Act, 2023 to enforce compliance with data protection obligations. It investigates personal data breaches, adjudicates complaints, issues directions to Data Fiduciaries, and imposes monetary penalties for violations of the Act. Its primary objective is to ensure that digital personal data is processed in accordance with the legal standards prescribed under the DPDP Act.

Q2. Can an individual directly approach the DPBI if their personal data is misused?

Answer:

Yes, but generally only after first using the grievance redressal mechanism provided by the concerned Data Fiduciary. If the grievance remains unresolved or the individual is dissatisfied with the response, a complaint may be brought before the DPBI in accordance with the procedure prescribed under the DPDP Act and the applicable Rules. The Board then examines the matter and may conduct an inquiry if a prima facie case is established.

References

1. Digital Personal Data Protection Act, 2023.

2. Digital Personal Data Protection Rules, 2025.

3. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

4. Ministry of Electronics and Information Technology, Government of India, Digital Personal Data Protection Framework.

5. Constitution of India, Article 21.

6. Justice B.N. Srikrishna Committee Report on Data Protection (2018).