The Board’s proceedings are digital, documentary and penalty-focused. AMLEGALS builds the defence on the Data Fiduciary’s own compliance records — notices, consent logs, safeguard documentation and breach-response timelines — and positions the Section 33 factors to secure a proportionate outcome.
The Data Protection Board of India is constituted as a digital-by-design adjudicatory body under Section 18 of the DPDPA. It does not regulate — it adjudicates complaints filed by Data Principals and conducts inquiries into alleged non-compliance. Its proceedings are conducted digitally, its orders impose monetary penalties under the Schedule and its decisions are subject to appeal before the Appellate Tribunal under Section 29.
AMLEGALS represents Data Fiduciaries and Data Processors in every stage of Board proceedings — from the first complaint response through inquiry, hearing, order and appeal. The defence is constructed on the client’s compliance evidence: Section 5 notices actually served, Section 6 consent logs actually maintained, Section 8(5) safeguards actually deployed and Rule 7 breach intimations actually filed. Where contraventions are established, the practice deploys the Section 33 factors — nature of the personal data, repetition, mitigation and proportionality — to contain the penalty exposure.
Analysing the Data Principal’s complaint, mapping it against the client’s processing records and grievance-redressal log, and drafting the response.
Responding to the Board’s inquiry notice with a structured evidentiary submission covering the alleged contravention.
Building the mitigation case on the Section 33 factors: nature of contravention, sensitivity of data, mitigation steps, repetition, financial gain and proportionality.
Where the proceeding concerns breach notification under Section 8(6) and Rule 7, demonstrating the timeline of awareness, intimation and remediation.
Preparing the digital hearing submission, evidence bundles and oral arguments before the Board.
Filing and arguing the appeal under Section 29 before the Appellate Tribunal within the sixty-day limitation period.
The Data Protection Board is constituted under Section 18 of the Digital Personal Data Protection Act 2023. It is a digital-by-design adjudicatory body that determines complaints by Data Principals, conducts inquiries into alleged non-compliance and imposes penalties under the Schedule. The Board is not a regulator — it does not issue regulations or guidance. Its orders are appealable to the Appellate Tribunal under Section 29.
A Data Principal may file a complaint under Section 13 after first approaching the Data Fiduciary with a grievance through the designated grievance redressal mechanism. If the Data Fiduciary fails to respond within the prescribed period or the response is unsatisfactory, the Data Principal may approach the Board. Complaints may relate to failure to provide notice (Section 5), processing without consent (Section 6), refusal to honour rights under Sections 11–14, or breach of security safeguards (Section 8(5)).
The Schedule to the DPDPA prescribes penalty ceilings for different contraventions: up to ₹250 crore for failure to take reasonable security safeguards (Section 8(5)), up to ₹200 crore for failure to notify the Board and Data Principals of a breach (Section 8(6)), up to ₹200 crore for non-compliance with obligations regarding children (Section 9), up to ₹150 crore for breach of the additional obligations of a Significant Data Fiduciary (Section 10), up to ₹50 crore for breach of any other provision of the Act or the Rules, and up to ₹10,000 for Data Principal duty violations under Section 15. The amount is determined by the Board after inquiry, having regard to the factors in Section 33(2).
The defence begins with analysing the complaint or inquiry notice against the client’s actual processing records. The response is built on evidence — the itemised notice under Section 5, consent logs, safeguard documentation, breach-response records and grievance-redressal correspondence. Where the contravention is technical or has been remediated, the defence emphasises the Section 33 factors (nature of contravention, mitigation, repetition, financial gain and proportionality) to argue for a proportionate outcome.
Yes. Section 29 provides for an appeal to the Appellate Tribunal constituted under the Telecom Regulatory Authority of India Act 1997. The appeal must be filed within sixty days of the Board’s order (extendable by a further sixty days if sufficient cause is shown). The Appellate Tribunal has the power to confirm, modify or set aside the Board’s order. Further appeal lies to the High Court under Section 30 on a substantial question of law.
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing.
Share the Board notice or complaint details for a confidential preliminary assessment.