DPDP Act 2023 · s. 27 · Ch. VIUpcoming · 13 May 2027

Powers and functions of Board

Status: Upcoming
Applies from: 13 May 2027G.S.R. 843(E)
Penalty: No separate penalty
Binds: No direct duty on companies

In plain English

The Board directs urgent remedial measures when it is told of a personal data breach, inquires into the breach and imposes penalties; it inquires into complaints by Data Principals, references by the Government, and breaches by Consent Managers; and it may direct the parties to mediation or accept a voluntary undertaking. Clause (1)(d), on complaints against Consent Managers, comes into force on 13 Nov 2026 with the rest of the Consent Manager provisions; the rest of the section on 13 May 2027.

Gazette text · s. 27The Board shall exercise and perform the following powers and functions, namely:—

(1)
The Board shall exercise and perform the following powers and functions, namely:—
1. (a)
  on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;
2. (b)
  on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;
3. (c)
  on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act;
4. (d)
  on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and
5. (e)
  on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act.
(2)
The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same.
(3)
The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.

Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)

Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); DPDP Act 2023, s. 27 · Change log