What is Data Protection Board under DPDP Law

September 5, 2024
The Data Protection Board: What Businesses Need to Know

Summary

  • The Data Protection Board (DPB) is the key regulatory authority under the DPDP Act, responsible for enforcing data protection regulations.
  • The DPB has the power to investigate, adjudicate, and impose penalties of up to ₹250 Crore for violations of the DPDP Act.
  • The DPB can address complaints from individuals (Data Principals) regarding data breaches and mishandling by Data Fiduciaries and issue mandatory corrective actions.
  • The DPB will operate as a digital office, enabling faster complaint resolution and requiring businesses to maintain thorough digital records.
  • Businesses should proactively review data practices, manage consents, and prepare for DPB investigations to remain compliant.
  • Businesses must notify the DPB of breaches within 72 hours, with detailed reports on the breach, impact, and remedial actions.

The Digital Personal Data Protection (DPDP) Act 2023 establishes the Data Protection Board of India (DPB) at its heart. This powerful regulatory body is tasked with ensuring compliance with the DPDP Act and safeguarding personal data.

What is the Data Protection Board?

What is Data Protection Board under DPDP Law - illustration

The DPB is the central authority established under the DPDP Act to investigate, adjudicate, and impose penalties that can reach up to ₹250 Crore per violation.

Key Powers and Functions

What is Data Protection Board under DPDP Law - illustration
The Data Protection Board is tasked with investigating breaches, adjudicating complaints and imposing fines

The DPB can investigate and enforce DPDP Act violations, manage data breaches, and adjudicate complaints from Data Principals, state/central governments, or courts.

The Complaint and Adjudication Process

What is Data Protection Board under DPDP Law - illustration
Decision of the board can be appealed to the TDSAT and a final review lies with the Supreme Court

DPB’s Structure and Operations

What is Data Protection Board under DPDP Law - illustration

The DPB is structured to function independently, free from external influence, and operates primarily as a digital office.

What is Data Protection Board under DPDP Law - illustration
The DPB's digital-first approach aligns with the DPDP Act’s emphasis on technology-driven governance

The DPB is yet to be officially established. Businesses must stay updated on the timeline for its formation, as this will mark the beginning of enforcement actions.

Sign up for a demo and early trial access

Customized Demo for every use case
Deep dive into your unique needs and compliance challenges
Free access to testing account
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.