6.7 Powers & Functions of the Board
Section 27 enumerates the Board's powers and functions. The DPB operates primarily on a complaint-driven model — it acts on intimations, complaints, references, or court directions rather than conducting proactive regulatory inspections.
Section 27(1): Triggering Events
The Board exercises its powers upon:
| Trigger | Source | Section Reference |
|---|---|---|
| (a) Personal data breach intimation | Data Fiduciary | Section 8(6) |
| (b) Data Principal complaint | Affected individual | Breach of DF obligations / DP rights |
| (b) Government reference | Central/State Government | Any breach |
| (b) Court direction | Any court | Compliance with directions |
| (c) Consent Manager complaint | Data Principal | CM obligation breach |
| (d) CM registration breach | Intimation received | Registration condition breach |
| (e) Intermediary breach | Central Government reference | Section 37(2) breach |
Section 27(2): Direction-Making Power
"The Board may, for the effective discharge of its functions... after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary..."
— Section 27(2), DPDPA 2023Directions issued under Section 27(2) are binding — the person "shall be bound to comply with the same." Non-compliance can attract additional penalties and contempt proceedings.
Section 27(3): Modification Powers
The Board may modify, suspend, withdraw, or cancel its directions:
- On representation by affected person
- On reference by Central Government
- Subject to conditions the Board deems fit
6.8 Inquiry Procedure (Section 28)
Section 28(3): Preliminary Determination
On receipt of intimation/complaint/reference, the Board first determines whether there are sufficient grounds to proceed with inquiry.
If Insufficient Grounds (S.28(4)):
- Board may close proceedings
- Must record reasons in writing
If Sufficient Grounds (S.28(5)):
- Board may inquire into affairs of any person
- Purpose: Ascertain compliance with DPDPA
- Must record reasons in writing
Inquiry Process Flow
Receipt of Intimation/Complaint/Reference
Board receives matter through one of the Section 27(1) channels
Preliminary Assessment
Board determines if sufficient grounds exist to proceed (S.28(3))
Inquiry Commenced
If grounds exist, inquiry begins following natural justice principles (S.28(6))
Interim Orders (if necessary)
Board may issue interim orders after hearing and recording reasons (S.28(10))
Opportunity of Hearing
Person concerned given opportunity to be heard
Final Order
Board either closes proceedings OR proceeds to impose penalty under S.33 (S.28(11))
Inquiry must be completed within 6 months from receipt. Extensions of up to 3 months at a time may be granted for recorded reasons.
6.9 Civil Court Powers
Section 28(7): CPC Powers
The Board has the same powers as a civil court under the Code of Civil Procedure, 1908 in respect of:
| Power | Provision | Practical Application |
|---|---|---|
| (a) Summoning & examination | Summoning persons, enforcing attendance, examining on oath | Compel witnesses to appear and testify |
| (b) Evidence & discovery | Receiving evidence of affidavit, requiring discovery and production of documents | Obtain documentary evidence |
| (c) Inspection | Inspecting data, books, documents, registers, books of account | Examine records and data systems |
| (d) Other matters | As prescribed by Rules | Additional procedural powers |
These CPC powers confirm the Board's quasi-judicial character. It can compel attendance, administer oaths, and require document production — essential for effective fact-finding.
Section 28(8): Operational Protection
"The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person."
— Section 28(8), DPDPA 2023This provision balances enforcement with business continuity — the Board cannot:
- Block access to business premises
- Seize equipment that would disrupt operations
Section 28(9): Police Assistance
The Board may requisition services of any police officer or Central/State Government officer. Such officers are duty-bound to comply.
6.10 Natural Justice Requirements
Section 28(6): Mandatory Compliance
"The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry."
— Section 28(6), DPDPA 2023Core Natural Justice Principles
| Principle | Latin Maxim | Application in DPB Proceedings |
|---|---|---|
| Right to be heard | Audi alteram partem | Opportunity of hearing before any adverse order (S.27(2), S.28(10), S.28(11), S.33(1)) |
| Rule against bias | Nemo judex in causa sua | Members with interest must recuse (Rule 18(5) — no participation in matters where interest exists) |
| Reasoned decisions | — | Reasons must be recorded in writing (S.28(4), S.28(5), S.28(10), S.28(11)) |
Natural justice violations are grounds for appeal. Document every procedural irregularity: inadequate notice, insufficient hearing time, unexplained reasons, or potential bias. These can be powerful arguments before TDSAT.
6.11 Frivolous Complaints
Section 28(12): Complainant Liability
"At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant."
— Section 28(12), DPDPA 2023This provision deters abuse of the complaint mechanism:
- Warning: Caution to complainant about improper use
- Costs: Financial penalty for false/frivolous complaints
If representing a Data Fiduciary facing a clearly frivolous complaint, consider filing an application highlighting the false or frivolous nature early — this may lead to dismissal with costs and deter similar complaints.
6.12 Exclusion of Civil Court Jurisdiction
Section 39: Jurisdiction Bar
"No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act."
— Section 39, DPDPA 2023This provision:
- Ousts civil court jurisdiction for matters within DPB's purview
- Bars injunctions against DPB actions
- Channels disputes through the specialized DPB → TDSAT appellate structure
Section 39 does not bar constitutional writ jurisdiction under Article 226 (High Court) or Article 32 (Supreme Court). However, courts typically require exhaustion of statutory remedies before entertaining writs.
🎯 Key Takeaways
- Complaint-driven model: Board acts on intimations, complaints, references, court directions
- Civil court powers: Summoning, evidence, inspection under CPC 1908
- Natural justice mandatory: Hearing, no bias, reasoned decisions required
- 6-month timeline: Inquiry completion deadline with 3-month extensions
- Operational protection: Cannot disrupt day-to-day business functioning
- Frivolous complaint liability: Warnings or costs for false/frivolous complaints
- Civil court bar: Section 39 ousts civil jurisdiction; no injunctions