What is the Data Protection Board of India?
The Data Protection Board of India (DPBI) is the adjudicating body created by the Digital Personal Data Protection Act, 2023 to enforce that law. It is not a policy-maker: the central government writes the rules (the DPDP Rules 2025), and the Board does not certify or license businesses. Its job is to receive complaints and breach intimations, inquire into whether a Data Fiduciary or a consent manager has broken the Act, direct urgent remedial or mitigation measures after a breach, and impose financial penalties.
A matter reaches the Board in one of three ways: a complaint from a Data Principal, who must first have used the business's own grievance channel; an intimation of a personal-data breach from the fiduciary itself; or a reference from the central government, a state government or a court. If the Board finds sufficient grounds it holds an inquiry. At any stage it can send a dispute to mediation or accept a voluntary undertaking from the business, which settles the matter on the terms agreed.
Penalty caps come from the Act's Schedule: up to 250 crore rupees for failing to take reasonable security safeguards, and up to 200 crore rupees for failing to notify a breach or for breaching the duties on children's data, with lower caps elsewhere. The Board sets the amount after weighing the nature, gravity and duration of the breach, the type of data affected, whether it was repeated, any gain made or loss avoided, and what the business did to mitigate it. Its orders can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days.
The Board was formally established in November 2025, when the DPDP Rules 2025 brought its provisions into force; appointment of its Chairperson and Members is a separate step, so check the Board's current composition and published procedures before relying on timelines. It is designed as a digital office, with complaints, hearings and orders handled online. It is separate from CERT-In, which receives cyber-security incident reports under its own directions, and from Meta, which enforces WhatsApp's policies on your account.
Key takeaways
- The Data Protection Board of India is the body that enforces the DPDP Act: it inquires into breaches and imposes penalties.
- A case starts from a person's complaint, a business's own breach intimation, or a reference from the government or a court.
- Penalties can reach 250 crore rupees per instance; the Board weighs gravity, duration, repetition and mitigation.
- It works as a digital office, and its orders can be appealed to TDSAT within 60 days.
- People must use the business's own grievance channel before they can complain to the Board.
How does the Data Protection Board of India work?
- Step 1
A matter reaches the Board
Through a complaint (after the person has tried your grievance channel), your own breach intimation, or a reference from the central or a state government or from a court.
- Step 2
The Board checks for grounds
It decides whether there are sufficient grounds to inquire. If not, it closes the matter, and it can warn or impose costs on a complainant whose complaint is false or frivolous.
- Step 3
Inquiry, mediation or undertaking
It hears the parties, largely online, and can order urgent mitigation after a breach. It may refer the dispute to mediation or accept a voluntary undertaking from the business.
- Step 4
Penalty decided
If it finds a significant breach, it imposes a penalty within the Schedule's caps after weighing gravity, duration, repetition and mitigation.
- Step 5
Appeal and escalation
Either side can appeal to TDSAT within 60 days. Where penalties have been imposed on a fiduciary in two or more cases, the Board can refer it to the government, which may block access to its service in India.
The Data Protection Board of India: key facts and limits
- Created by
- DPDP Act 2023, Chapter V
- Ways in
- Complaint, breach intimation, government or court reference
- Highest penalty
- Up to 250 crore rupees (security safeguards)
- Other caps
- Up to 200 crore rupees (breach notice, children's data)
- Works as
- A digital office: online filing and hearings
- Appeals
- TDSAT, within 60 days of the order
- Established
- November 2025, with the DPDP Rules 2025
Why the difference matters
Why does the Data Protection Board of India matter?
For a business messaging customers on WhatsApp, the Board is where a consent complaint or a leaked contact list becomes a legal case. Knowing how a case starts, and that a breach you report yourself is one of the ways, shapes the parts of compliance that matter most in practice: a grievance channel that actually answers, a breach plan that tells the Board and customers promptly, and records showing the business took mitigation seriously.
Example: A leaked broadcast list in Kochi
Picture this once the duties apply in 2027. A Kochi travel agency's marketing contractor shares its WhatsApp broadcast list (40,000 names and numbers) through a public file link. The agency spots it on a Monday, revokes the link, messages affected customers and intimates the breach to the Board the same day. Because it reported promptly, can produce its processor contract and access logs, and offers a voluntary undertaking to tighten access, it is in the strongest position the Act allows. An agency that hid the breach would risk a penalty for failing to notify on top of one for the security lapse.
Common mix-ups
Common mistakes with the Data Protection Board of India
Having no working grievance channel
People must try your grievance channel before going to the Board, so a missing or slow one sends complaints straight there. Publish a contact and answer within the period the DPDP Rules set.
Hiding a breach to avoid attention
Failing to notify has its own penalty cap of up to 200 crore rupees, while prompt reporting and mitigation count in your favour. Report to the Board and to affected people.
Confusing the Board with CERT-In or Meta
A cyber incident may also need a CERT-In report (within six hours under its 2022 directions), and Meta may restrict your account separately. None of the three replaces the others.
Reading the caps as fixed fines
The amounts are ceilings. The Board weighs gravity, repetition and mitigation, so evidence of good practice (contracts, logs, a quick response) directly reduces exposure.
DPBI FAQs
Can a customer complain to the Data Protection Board about WhatsApp spam?+
How much can the Data Protection Board fine a company?+
Where do appeals against the Board's orders go?+
Is the Data Protection Board operating yet?+
Rules of thumb
Best practices for the Data Protection Board of India
- Keep a breach log with times, decisions and messages sent; it is your evidence of mitigation.
- Name one owner for Board correspondence and keep your DPDP contact details current.
- Require your BSP, by contract, to report breaches to you fast enough for you to notify.