INTRODUCTION
A law is only as good as its enforcement. This simple truth is at the heart of this research which asks: how does India’s new data protection law actually work when someone breaks the rules? Who investigates complaints? Who punishes wrongdoers? And crucially can that enforcement body be trusted to act fairly and independently?
The Digital Personal Data Protection Act, 2023 (‘DPDP Act’) created the Data Protection Board of India (‘DPB’ or ‘the Board’) as the main enforcement body. This is a completely new institution, India did not have a dedicated data protection regulator before. Under the earlier Information Technology Act, 2000, complaints were handled by adjudicating officers appointed by state governments, which was considered an inaccessible and ineffective system. The DPB is meant to be a modern, digital-first, tech-savvy body that can handle the complex world of data privacy.
However, as the DPB comes with several significant concerns, especially regarding its independence from the government, the accessibility of its digital proceedings, the adequacy of its penalties, and the risks posed by the voluntary undertaking mechanism. This paper explains all of these.
WHAT IS THE DATA PROTECTION BOARD?
ESTABLISHMENT AND COMPOSITION
The Data Protection Board of India is set up under Section 18 of the DPDP Act.1 Think of it as a specialised court, but one that only deals with data protection disputes. Its main jobs are: (1) hearing complaints from individuals (called ‘data principals’) whose data rights have been violated; (2) investigating breaches of the DPDP Act and its Rules; (3) imposing financial penalties on organisations (called ‘data fiduciaries’) that break the law; and (4) accepting voluntary undertakings from organisations willing to fix their violations.
The Board consists of a Chairperson and as many other members as the Central Government decides to appoint. Rule 15 of the DPDP Rules requires that these members must be qualified and experienced in areas like data governance, information technology, or law.2 The appointments are made by the Central Government under Section 19(1) of the Act.3
B. Why ‘Fiduciary’ Language Matters
The DPDP Act deliberately uses the word ‘fiduciary’ to describe organisations that handle personal data. This is not an accident. In law, a fiduciary is someone who must act in the best interests of another person like a doctor who must act in the patient’s best interest, or a trustee who must manage property for the benefit of beneficiaries. By calling data processors ‘fiduciaries,’ the law signals that they must act responsibly and in the interests of users, not just for their own profit. The DPB exists precisely to enforce this duty.
THE BIG PROBLEM: IS THE BOARD REALLY INDEPENDENT?
This is the most important and most debated issue about the DPB. For any enforcement body to work properly, it must be independent, meaning it should not be under the control of the very people it is supposed to regulate. Imagine if a cricket umpire was appointed and paid by one of the teams. Even if the umpire tried to be fair, everyone would doubt their decisions. The same logic applies to the DPB.
A. The Appointment and Removal Problem
Under the DPDP Act, the Central Government has complete control over who gets appointed to the DPB and who gets removed. Section 19(1) gives the government the sole power of appointment, with no requirement to consult an independent body, get parliamentary approval, or follow a transparent selection process. Section 25 gives the government the power of removal, with the only safeguard being an inquiry by a Supreme Court judge.4
This is not just a matter of institutional design preference, it is a constitutional question.5 If the Board is supposed to hold government agencies accountable for data protection violations, how can it do so credibly when its members serve at the pleasure of the government? The Puttaswamy judgment made clear that the constitutional right to privacy must be genuinely enforceable, and an enforcement body that depends on the government for its very existence cannot credibly do this.6
B. Comparison with Other Countries
To understand how unusual India’s arrangement is, it helps to compare it with how other countries ensure the independence of their data protection regulators:
| Country / Region | Appointment Mechanism | Independence Safeguards |
|---|---|---|
| United Kingdom | Crown appoints Information Commissioner on recommendation of Secretary of State | Fixed term; removal only on defined statutory grounds |
| European Union | European Parliament and Council jointly appoint the European Data Protection Supervisor | Independence from executive ensured by legislative appointment; full operational autonomy |
| India (Election Commission for comparison) | Collegium-based appointment mechanism (SC upheld requirement for structural independence) | Constitutional protection; removal only through parliamentary process |
| India (DPB- DPDP Act) | Central Government alone appoints, with no consultation required | No fixed term guaranteed; removal power vested in government; no structural independence |
As the table above shows, India’s arrangement for the DPB falls significantly short of comparable international standards.7
HOW DOES THE BOARD HEAR CASES?
DIGITAL-BY-DEFAULT PROCEEDINGS
One of the most innovative features of the DPB is that it operates entirely online.8 If you believe your data rights have been violated, you can file a complaint from your home, without hiring a lawyer, without visiting a government office, and without waiting in long queues. Section 28 of the DPDP Act mandates that all proceedings before the Board will happen through digital or electronic means prescribed by the rules. Section 29 sets out the basic process: the Board notifies the accused data fiduciary, examines the circumstances, offers both sides a chance to be heard, and then passes an order.
The Board also has the powers of a civil court for investigative purposes, it can summon people, demand documents, and receive evidence on affidavit.9 This is a major improvement over the earlier IT Act system, which required people to physically visit state government adjudicating officers.
B. The Digital Divide Concern
While going fully digital sounds modern and efficient, there is a serious problem: not every Indian has reliable internet access or knows how to use online government systems confidently. India still has a significant digital divide between urban and rural populations, between the educated and the less educated, and between the wealthy and the poor. A dispute resolution system that is entirely online may, in practice, be accessible only to tech-savvy urban users, while the most vulnerable people, who are often the most likely to be exploited, are left out. The DPDP Rules currently do not provide any alternative mechanism for individuals who cannot access digital services.
APPEALS: GOING TO TDSAT
If a person is unhappy with the DPB’s decision, they can appeal to the Telecom Disputes Settlement and Appellate Tribunal (‘TDSAT’) under Section 31 of the DPDP Act.10 TDSAT is an existing tribunal that was originally set up to handle disputes in the telecom and broadcasting sectors.
The decision to use an existing tribunal rather than creating a brand new appellate body is understandable it saves money and avoids bureaucratic delay. But it raises a practical concern: TDSAT judges and staff are experts in telecom law, not data protection law. Data protection cases can be highly complex, involving technical questions about how algorithms work, how personal data is processed, and what privacy best practices look like globally. Asking a general-purpose tribunal to decide these cases without specialist expertise creates a real risk of poor-quality decisions.
PENALTIES: ARE THEY STRONG ENOUGH?
THE PENALTY STRUCTURE
The DPDP Act’s Schedule sets out the financial penalties that the Board can impose.11 These are summarised in the table below:
| Type of Violation | Maximum Penalty |
|---|---|
| Significant Data Fiduciary breaching its obligations; failure to protect children’s data | Rs. 250 crore (USD 30 million) |
| Failure to notify the Board of a personal data breach | Rs. 200 crore (USD 24 million) |
| Data principal filing a false or frivolous complaint | Rs. 10,000 (USD 120) |
Financial penalty structure under the DPDP Act, 2023.
B. Are These Penalties Enough to Deter Big Tech?
At first glance, Rs. 250 crore sounds like a lot of money. But for global technology companies like Meta, Google, or Amazon, it is virtually nothing.12 These companies earn tens of billions of dollars every year. A Rs. 250 crore fine is a fraction of a percent of their revenue, so small that it could be absorbed without changing behaviour at all.
Compare this with the EU’s General Data Protection Regulation (GDPR), which can fine companies up to EUR 20 million or 4% of their total global annual revenue, whichever is higher. For a company earning $100 billion a year, this means a maximum fine of $4 billion under the GDPR, compared to just about $30 million under India’s DPDP Act. The deterrent effect of the Indian regime is, therefore, structurally weaker for large multinational companies.13
That said, the penalty regime is not entirely without effect. The Rs. 250 crore figure is the ceiling , the Board can impose lower penalties that are proportionate to the severity of the violation, the harm caused, and the company’s compliance history. The Board can also order companies to stop processing data, which for a data-driven business can be far more damaging than any financial fine. Thus, while the penalty structure is weaker than the GDPR, it is not meaningless.
THE VOLUNTARY UNDERTAKING MECHANISM
WHAT IS A VOLUNTARY UNDERTAKING?
Section 32 of the DPDP Act introduces an interesting mechanism called ‘voluntary undertakings.’14 This means that a company under investigation can voluntarily approach the Board and offer to: (1) comply with the specific provision of the Act it has been violating; (2) take specific remedial action to fix the harm caused; or (3) pay a specific sum of money to the Board. If the Board accepts this offer, it can suspend or even close the investigation.
This is similar to the ‘deferred prosecution agreement’ framework used in England and Wales, where criminal proceedings can be suspended if a company agrees to meet certain conditions.15 In theory, this allows for faster and more flexible resolution of cases.
B. Advantages and Risks
The voluntary undertaking mechanism has both genuine advantages and real risks:
Advantages:
1. It saves the Board’s resources for more serious cases rather than tying up its time with minor violations.
2. It can result in better outcomes for affected users, for example, a company might agree to delete all improperly collected data, which a formal penalty order alone may not compel.
3. It encourages proactive compliance rather than defensive litigation.
Risks:
1. Wealthy companies may use voluntary undertakings to ‘buy their way out’ of serious investigations, making low-cost commitments to avoid real accountability.
2. There are no clear criteria for when the Board should accept or reject an undertaking, which could lead to inconsistency or, worse, favouritism.
3. There are no public reporting requirements for undertakings that are accepted, which reduces transparency and makes it harder for the public to know whether violations are being properly addressed.
CRITICAL ANALYSIS
STRENGTHS
The DPB represents a genuine and significant improvement over India’s previous data protection regime. The creation of a dedicated, specialist enforcement body, rather than relying on generalist civil courts or part-time adjudicating officers shows that India is serious about data protection. The digital-by-default approach makes the complaint process theoretically accessible to millions of users. The Board’s powers, including the ability to order cessation of data processing, go beyond mere financial penalties and provide potentially powerful tools for enforcement.
B. Weaknesses
However, the DPB’s structural weaknesses are serious. The most critical is the independence problem: a regulator controlled by the government cannot credibly regulate the government. Given that the government is also one of the biggest ‘data fiduciaries’ in India, through Aadhaar, income tax systems, health data schemes, and more, the structural conflict of interest is acute. The absence of objective criteria for voluntary undertakings, the lack of prescriptive technical standards for enforcement, and the use of TDSAT (a non-specialist tribunal) for appeals all compound these weaknesses.
C. The Constitutional Dimension
The Puttaswamy judgment established privacy as a fundamental constitutional right. The enforcement of a fundamental right must meet the same high standards that the Constitution demands. If the DPB is structurally unable to hold the government accountable because it is appointed by and serves at the pleasure of the government then India’s constitutional right to privacy may be unenforceable against the state in practice. This is a constitutional concern, not just a policy one.
RECOMMENDATIONS
1. Structural independence of the DPB: The appointment process should involve an independent collegium or parliamentary committee, similar to the process upheld by the Supreme Court for the Election Commission of India. Board members should have fixed, non-renewable terms and should only be removable through a transparent judicial process.
2. Clear criteria for voluntary undertakings: The DPDP Rules should be amended to prescribe objective criteria including public reporting requirements for when the Board may accept a voluntary undertaking, so that the mechanism cannot be abused by well-resourced companies.
3. Alternative access for non-digital complainants: The Rules should provide physical or assisted-digital alternatives for individuals without reliable internet access, ensuring the complaint mechanism is genuinely inclusive.
4. Specialist appellate forum: Consideration should be given to either training TDSAT members in data protection law, or designating a dedicated appellate chamber with specialist expertise.
5. Penalty revision: The penalty ceiling should be reconsidered to include a turnover-based element, similar to the GDPR, to ensure that penalties are genuinely deterrent for large multinational companies.
CONCLUSION
The Data Protection Board of India represents a landmark institutional innovation in India’s legal landscape. For the first time, there is a dedicated, specialist regulator whose sole job is to enforce data protection rights. The digital-first complaint process, broad investigative powers, and flexible enforcement tools (including voluntary undertakings) show genuine ambition.
But ambition is not enough. The Board’s structural dependence on the government the same government that is one of India’s biggest data fiduciaries is a fundamental flaw that risks making the right to data privacy unenforceable against state actors. The penalty regime is too weak to deter the largest technology companies. The appeal mechanism lacks specialist expertise. And the voluntary undertaking procedure has the potential to be gamed by well-resourced violators.
India has built a foundation. The work now is to strengthen it. With targeted legislative reforms, particularly to ensure the structural independence of the Board and to set realistic penalty levels, the DPB could become a genuinely effective guardian of India’s digital rights. Without such reforms, it risks being an impressive-looking institution that lacks the teeth, and the independence, to do its job.
*****
Footnotes
1. Digital Personal Data Protection Act 2023 (Act No. 22 of 2023) (India), Section 18. The Board is established as the principal regulatory and adjudicatory body under the Act.
2. Digital Personal Data Protection Rules 2024 (Draft), Rule 15. The Rule prescribes qualifications for the Chairperson and members of the Board, requiring persons of ability, integrity and standing with experience in data governance, information technology, law or related fields.
3. DPDP Act 2023, Section 19(1). The provision vests the appointment power exclusively in the Central Government without any mandatory consultation with an independent body or parliamentary sanction.
5. Alok Prasanna Kumar, ‘Independence of Regulatory Bodies: A Constitutional Appraisal’ (2022) 57 Journal of the Indian Law Institute 312. Kumar argues that structural dependence of the Board on the executive is not merely an institutional design preference but a constitutional question.
6. K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1 (nine-judge Constitution Bench). The judgment unanimously held that privacy is a fundamental right under the Constitution of India and laid down the tripartite test of legality, necessity and proportionality.
7. DPDP Act 2023, Section 25; compare the UK model where the Crown appoints the Information Commissioner upon the recommendation of the Secretary of State, with a fixed term and defined grounds for removal; and the EU model where the European Parliament and the Council jointly appoint the European Data Protection Supervisor.
8. DPDP Act 2023, Sections 28 and 29. Section 28 mandates all proceedings to occur through digital or electronic methods. Section 29 prescribes the adjudicatory procedure including notice to the data fiduciary, examination of circumstances, opportunity of hearing, and making of orders.
9. DPDP Act 2023, Section 30. This provision empowers the Board with the powers of a civil court for purposes of inquiry, including summoning and enforcing the attendance of persons, requiring production of documents, and receiving evidence on affidavits.
10. Telecom Disputes Settlement and Appellate Tribunal Act 2000 (Act No. 7 of 2017 as amended), Section 14, conferring appellate jurisdiction on TDSAT. TDSAT was originally established under the Telecom Regulatory Authority of India Act 1997 to handle telecom and broadcasting disputes.
11. DPDP Act 2023, Schedule. The Schedule prescribes the penalty structure: up to Rs. 250 crore for breach of obligations by Significant Data Fiduciaries and children’s data obligations; up to Rs. 200 crore for failure to notify the Board of a personal data breach; and Rs. 10,000 for contravention of duties by a data principal.
12. General Data Protection Regulation (EU) 2016/679, Article 83. The GDPR provides for fines of up to EUR 20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, for the most serious violations.
13. Vishwajith Sadananda, ‘Deterrence and Data: The Penalty Architecture of the DPDP Act’ (2024) 12 Indian Journal of Law and Technology 1. Sadananda argues that while the penalty ceiling appears low compared to the GDPR, the Board retains flexibility to calibrate penalties to the severity of infringement and harm caused.
14. DPDP Act 2023, Section 32. The voluntary undertaking mechanism allows a data fiduciary subject to inquiry to provide the Board with an undertaking to comply with a provision of the Act, take specified remedial action, or pay a specified sum.
15. Crime and Courts Act 2013 (UK), Schedule 17, establishing the deferred prosecution agreement framework in England and Wales. This mechanism allows prosecutors to suspend criminal proceedings in return for the defendant company agreeing to comply with conditions including financial penalties and remediation of harm.