Data Protection Board of India The body that enforces India’s data protection law, and where it stands in 2026.
Short answer. The Data Protection Board of India is the body the Digital Personal Data Protection Act, 2023 sets up to enforce the Act. Section 18 establishes it as a body corporate. Section 27 lets it act on breach intimations, on complaints from data principals and on references from government: it can direct urgent remedial steps, inquire, and impose the penalties in the Schedule, up to ₹250 crore. Section 28 requires it to work as a digital office, and appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (section 29). In May 2026 MeitY invited applications for a Chairperson and four Members. A LiveLaw article on 1 August 2026 reported that none had yet been appointed, so check MeitY for the current position. This is general information, not legal advice.
01
Powers and functions (section 27)
On a breach intimation from a fiduciary: direct urgent remedial or mitigation measures, inquire, and impose a penalty.
On a data principal’s complaint about a breach or a fiduciary’s obligations, or on a reference from the Central or a State Government or a court’s direction: inquire and impose a penalty.
On a complaint about a consent manager, or an intimation that one has breached a condition of registration: inquire and impose a penalty.
On a reference from the Central Government about an intermediary that ignored a blocking direction: inquire and impose a penalty.
Issue directions to any person, after a hearing, and modify, suspend or cancel them on representation.
02
How a case runs
Step
Provision
Detail
Grievance first
Section 13(3)
A data principal must use the fiduciary’s grievance mechanism before approaching the Board.
Sufficient grounds?
Section 28(3) and (4)
The Board decides whether to proceed; if not, it closes the proceedings with recorded reasons.
Inquiry
Section 28(5) to (7); rule 19(9)
Civil court powers to summon, take evidence and inspect documents; the inquiry should finish within six months, extendable by up to three months at a time.
Interim orders
Section 28(10)
Possible during the inquiry, after a hearing.
Mediation or undertaking
Sections 31 and 32
The Board may send a complaint to mediation, or accept a voluntary undertaking that bars further proceedings on its contents.
Penalty
Section 33; Schedule
Only for a significant breach, after a hearing, weighing gravity, duration, mitigation and proportionality.
Appeal
Section 29
To TDSAT within 60 days; TDSAT should try to decide within six months.
03
Members and status as of October 2026
Section 19 leaves the number of Members to the Government and requires at least one to be an expert in law; each serves a two-year term (section 20(2)). Rule 17 sets up search-cum-selection committees, and the Fifth Schedule to the Rules fixes salaries at ₹4,50,000 a month for the Chairperson and ₹4,00,000 for each Member.
MeitY’s circular of 6 May 2026 says the Board has been established under section 18 and invites applications for one Chairperson and four Members. LiveLaw reported on 1 August 2026 that the Board still had no appointed Chairperson or Members. Check MeitY’s website before relying on any date.
04
What it means for an office
The Board is where a client or patient can take a complaint about how your office handled their data, after using your own grievance process. If AI tools were part of that processing, the Board can inspect data, documents and registers (section 28(7)(c)). A record of which tool processed which data, and who asked, makes those questions easier to answer. On ANVE, every model call is logged on the device with the user, the app and the model.
This page is general information, not legal advice. Ask a lawyer how the law applies to your office.
05
Questions people ask
Can I complain to the Board directly?
Only after using the data fiduciary’s or consent manager’s own grievance mechanism. Section 13(3) requires a data principal to exhaust that first.
What is the highest penalty the Board can impose?
Up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach (item 1 of the Schedule).
Does the Board work online?
Yes. Section 28(1) and rule 20 require it to function as a digital office, and it may hold proceedings that do not need anyone to be physically present.
Where do appeals against the Board go?
To the Telecom Disputes Settlement and Appellate Tribunal, within 60 days of receiving the order (section 29(1) and (2)).
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
