Sections 27–28: Powers and Procedure of the Data Protection Board

Statutory Text (Official Gazette)

Section 27. Powers and functions of Board

27. (1) The Board shall exercise and perform the following powers and functions, namely:—

(a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;

(b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;

(c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act;

(d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and

(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act.

(2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same.

(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.

Section 28. Procedure to be followed by Board

28. (1) The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed.

(2) The Board may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder.

(3) The Board shall determine whether there are sufficient grounds to proceed with an inquiry.

(4) In case the Board determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings.

(5) In case the Board determines that there are sufficient grounds to proceed with inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any person for ascertaining whether such person is complying with or has complied with the provisions of this Act.

(6) The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry.

(7) For the purposes of discharging its functions under this Act, the Board shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in respect of matters relating to—

(a) summoning and enforcing the attendance of any person and examining her on oath;

(b) receiving evidence of affidavit requiring the discovery and production of documents;

(c) inspecting any data, book, document, register, books of account or any other document; and

(d) such other matters as may be prescribed.

(8) The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person.

(9) The Board may require the services of any police officer or any officer of the Central Government or a State Government to assist it for the purposes of this section and it shall be the duty of every such officer to comply with such requisition.

(10) During the course of the inquiry, if the Board considers it necessary, it may for reasons to be recorded in writing, issue interim orders after giving the person concerned an opportunity of being heard.

(11) On completion of the inquiry and after giving the person concerned an opportunity of being heard, the Board may for reasons to be recorded in writing, either close the proceedings or proceed in accordance with section 33.

(12) At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant.

What Sections 27 and 28 Mean in Plain English

What Can Start a Board Case (Section 27(1))

1. Your own breach report: When you report a personal data breach under Section 8(6), the Board can order urgent steps to contain it, then inquire and penalise.
2. A user complaint: About a breach, about you failing your obligations, or about you ignoring their rights. A user must first use your grievance process under Section 13(3).
3. Government reference or court direction: The Central or a State Government can refer a matter, or a court can direct the Board to act.
4. Consent Manager issues: Complaints about a Consent Manager, or breaches of its registration conditions.
5. Intermediaries ignoring blocking orders: Under Section 37(2), on reference from the Central Government.

How an Inquiry Runs (Section 28)

• Screening first: The Board decides if there are sufficient grounds. If not, it closes the case with written reasons.
• Digital by design: Complaints, hearings and decisions are handled digitally as far as practicable (also Rule 20).
• Natural justice: You get a hearing before interim orders and before any final decision.
• Civil court powers: Summon people, take evidence on oath or affidavit, and inspect data, books and documents.
• Limits: The Board cannot block access to your premises or seize equipment in a way that disrupts daily business.
• Time limit: Rule 19(9) requires inquiries to finish within six months, extendable by up to three months at a time.
• False complaints: The Board can warn a complainant or impose costs if a complaint is false or frivolous.

Directions (Section 27(2) and (3))

After a hearing and with written reasons, the Board can issue binding directions. You can ask it to modify, suspend or cancel a direction.

What to Prepare

• Breach response file: Keep everything you would need to show the Board within hours of a breach report.
• Grievance records: Since users must use your grievance process first, good records of how you handled each grievance are your first line of defence.
• Consent evidence: Under Section 6(10), you must prove notice and consent if challenged.