The institution
The Data Protection Board of India (DPBI) is the regulator established under Sections 18-26 of the DPDP Act. As of late 2025 it has been formally constituted but is not yet fully operational. When fully operational, it becomes the central enforcement forum for the entire framework.
Composition
The Board comprises a Chairperson and other Members. The Government's emphasis on technical and legal expertise suggests members will include senior judges, regulators, and technologists. Tenure is two years, renewable.
Powers
The Board has wide powers:
- Inquire into breaches and other contraventions
- Direct urgent remedial measures
- Impose penalties up to the caps in the Schedule (₹250 Cr maximum for security failures)
- Issue directions to Data Fiduciaries
- Conduct proceedings as a digital office (significant — it's designed to operate online)
Procedural model
The Board is intended to be a digital-first regulator. Filings, hearings, evidence presentation — all conducted online. This is a deliberate choice for accessibility and speed; it also means your evidence-handling processes need to support digital production from day one.
Penalties are civil only. The DPDP Act does not create criminal offences (a notable departure from the IT Act). All proceedings result in directions and / or monetary penalties.
Appeal route
Appeals from the DPBI go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days of the order. From TDSAT, further appeal is to the Supreme Court on questions of law.
This route — DPBI → TDSAT → SC — is faster than the typical Indian regulatory ladder (regulator → High Court → SC). It's intended to enable a body of jurisprudence to develop quickly.
What to prepare
- Designate a single point of contact for DPBI inquiries — typically the DPO or Grievance Officer
- Document your decision-making for any contested processing — the audit trail matters more than the original decision
- Maintain the evidence chain for consent capture, security implementation, breach response. The Board will work from the documentary record.
- Test your incident-response process to ensure it produces Board-ready notification artefacts under time pressure
Early enforcement priorities
Speculative but informed by Government statements and analogous regulators globally:
- Notification compliance (did you actually report when you should have?)
- Children's data (Section 9) — high political salience
- Vendor and processor flow-down (Section 8(2)) — a high-leverage point
- Cross-border transfer compliance for SDFs once classified