Data Protection Board of India: what it does and can fine The DPDP Act's regulator: how a complaint reaches it, how it inquires, the penalty schedule, and where appeals go.

The Data Protection Board of India is the body established under section 18 of the Digital Personal Data Protection Act, 2023 to inquire into personal data breaches and complaints, direct remedies and impose the monetary penalties in the Act's Schedule. Section 18(1) provides that "there shall be established, for the purposes of this Act, a Board to be called the Data Protection Board of India". The Ministry of Electronics and Information Technology established it by G.S.R. 844(E) on 13 November 2025, "with effect from the date of publication of this notification in the Official Gazette", with its head office "in the National Capital Region of India". Section 19(1) says it "shall consist of a Chairperson and such number of other Members as the Central Government may notify".

What does the Data Protection Board do?

Section 27(1) lists its powers and functions. In a clinic's terms:

• On a breach intimation under s.8(6), "to direct any urgent remedial or mitigation measures", inquire and impose penalty (s.27(1)(a)).
• On a complaint by a Data Principal about a breach or about a Data Fiduciary's failure to meet its obligations or honour their rights, or on a reference by the Central or a State Government or a court, to inquire and impose penalty (s.27(1)(b)).
• On a complaint about a Consent Manager, or an intimation that one has breached its registration conditions, to inquire and impose penalty (s.27(1)(c) and (d)).
• To "issue such directions as it may consider necessary" after hearing the person (s.27(2)).

How does a complaint reach the Board and what happens next?

The patient must try the clinic first. Section 13(3) says the Data Principal "shall exhaust the opportunity of redressing her grievance" with the Data Fiduciary "before approaching the Board". Once a complaint arrives, s.28(1) says the Board "shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design". The Board first decides "whether there are sufficient grounds to proceed with an inquiry" (s.28(3)) and may close the matter if not. If it inquires, it has the powers of a civil court for summoning persons, taking evidence and inspecting documents (s.28(7)), but s.28(8) bars it from taking "into custody any equipment or any item that may adversely affect the day-to-day functioning of a person". Rule 19(9) of the DPDP Rules, 2025 says the inquiry "shall be completed within a period of six months" from receipt. Appeals go to the Appellate Tribunal within sixty days (s.29).

What penalties can the Board impose?

Section 33(1) lets the Board, where a breach "is significant", impose the monetary penalty in the Schedule after hearing the person. Section 33(2) lists what it must weigh, including "the nature, gravity and duration of the breach", "the type and nature of the personal data affected", whether the breach is repeated and whether the person "took any action to mitigate the effects". The Schedule:

These are ceilings, not fixed fines; s.33(2) directs the Board to proportion the penalty to the breach. There is no small-business tier in the Schedule, so the same ceilings apply to a one-doctor clinic and a hospital chain.

What does the Board mean for a small clinic?

A patient who believes the clinic shared their records with a lab without consent first writes to the clinic's named contact. If unanswered, they file online with the Board, which decides whether there are grounds and, if so, asks the clinic for its records and explanation. The Board's own sections (18 to 26) are in force now, but the clinic obligations it would enforce, sections 3 to 10 and 11 to 17, commence eighteen months after 13 November 2025 under G.S.R. 843(E). The timeline and the obligations are set out in our guide to the DPDP Act for clinics; the roles are defined under Data Fiduciary and Data Principal.