The Board sets penalties case by case, up to fixed ceilings.

Members

A Chairperson and other Members the government notifies. At least one must be an expert in law.

Appointment

Through search-cum-selection committees set out in the Rules, one for the Chairperson and one for other Members.

Term

Two years, with re-appointment allowed.

Meetings

A quorum of one-third of Members; decisions by majority, with a casting vote for the chair.

Digital office

Complaints, hearings and decisions run digitally by design, while keeping the power to summon people.

The Board has been established, and the Rules' provisions on its constitution took effect when the Rules were published. In 2026 the Ministry advertised for a Chairperson and four Members; check the current position before citing who sits on it.

1. A matter starts with a breach intimation, a complaint from a person, a reference from a government, or a court's direction. A person must first use your grievance channel.
2. The Board decides whether there are sufficient grounds. If not, it closes the matter with reasons.
3. If so, it inquires following natural justice, with civil-court powers to summon people, take evidence and inspect data and documents.
4. It may not seize equipment or block premises in a way that disrupts daily operations.
5. It may issue interim orders after hearing you, and may send a complaint to mediation where that suits.
6. Under the Rules, the inquiry should finish within six months of the intimation or complaint, extendable by up to three months at a time with reasons.
7. At the end, after a hearing, the Board either closes the matter or moves to a penalty.

Complaints the Board finds false or frivolous can earn the complainant a warning or costs. The Act also gives individuals duties, with a ceiling of up to ₹10,000 for breaching them.

1. 1Nature, gravity, durationHow serious the breach was and how long it lasted.
2. 2Type of dataWhat kind of personal data was affected.
3. 3RepetitionWhether it has happened before.
4. 4Gain or avoided lossWhether you profited or saved money through the breach.
5. 5MitigationWhat you did to limit the damage, and how fast and how well.
6. 6Proportion and deterrenceWhether the amount is proportionate and still deters.
7. 7Impact on youThe likely effect of the penalty on the person paying it.

Three of these are under your control long before any inquiry: how quickly you detect a problem, how well you respond, and whether you fix the cause so it does not recur. Evidence of all three is the best mitigation you can bring.

Anyone aggrieved by a Board order or direction may appeal to TDSAT within sixty days of receiving it. The tribunal can admit a late appeal for sufficient cause. It aims to decide within six months, and records reasons if it cannot. Under the Rules, appeals are filed digitally, with a fee matching appeals under the TRAI Act unless waived or reduced.

A TDSAT order can be executed like a civil court decree. Any further challenge follows the route the TRAI Act sets for appeals from the tribunal. Penalties collected go to the Consolidated Fund of India, not to the people affected.

Repeat offenders face one more lever. Where the Board has penalised a fiduciary in two or more instances and advises it, the government may, after a hearing, order public access to the fiduciary's service in India to be blocked.

Sources: the Digital Personal Data Protection Act, 2023 (sections 13, 18 to 34 and 37, and the Schedule) and the Digital Personal Data Protection Rules, 2025 (rules 1 and 17 to 22), as published by the Ministry of Electronics and Information Technology, and a 2026 Ministry notice on Board appointments.