Law note · India
Digital Personal Data Protection Act, 2023, Data Protection Board and penalties
What it requires
- The Data Protection Board of India exists, is administratively operational, and its jurisdiction ousts the civil courts over matters within its remit, but its penalty Schedule, complaint, and appeal machinery has not yet commenced and is scheduled for 13 May 2027, and no provision of the Act as read gives the Board power to award compensation to an individual complainant. Once fully in force, an app processing Indian personal data, including biometric identifiers, will answer only to the Board; India's DPDPA arms no private plaintiff, and a data principal who misuses their own rights under the Act, for example by impersonation or a frivolous complaint, risks a penalty of their own under section 15.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
- Private right of action
- No
What we found
The Data Protection Board of India (Chapter VI, ss.18-26) is established and administratively operational, and section 39's ouster of civil-court jurisdiction over any matter the Board is empowered to decide is also in force, both since 13 November 2025 under Notification G.S.R. 843(E), clause (a).
Its penalty powers, set out in the Schedule under s.33(1), are exclusively civil monetary: up to Rs 250 crore for a failure to take reasonable security safeguards, up to Rs 200 crore for failing to notify a breach, up to Rs 200 crore for a children's-data violation, up to Rs 150 crore for a Significant Data Fiduciary violation, and up to Rs 10,000 for a data principal's own breach of their s.15 duties (impersonation, suppressing material information, frivolous complaints).
No provision found authorizes the Board to award compensation to an affected data principal directly; its penalties are payable to government. Section 33 (the penalty Schedule) and the rest of the complaint and appeal machinery (ss.27-34, except s.27(1)(d)) have not commenced; Notification G.S.R. 843(E), clause (c), appoints eighteen months from its own publication date, 13 May 2027, as their commencement date.