6.19 Appeal to Appellate Tribunal (Section 29)
Section 29 provides the appellate remedy against DPB orders. Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) — an existing specialized tribunal with technical expertise.
Section 29(1): Right of Appeal
"Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal."
— Section 29(1), DPDPA 2023Appeal Procedure
| Aspect | Requirement | Section |
|---|---|---|
| Limitation period | 60 days from receipt of order | S.29(2) |
| Condonation of delay | Permitted if sufficient cause shown | S.29(3) |
| Form & manner | As prescribed by Rules | S.29(2) |
| Fee | As prescribed | S.29(2) |
| Expeditious disposal | As expeditiously as possible | S.29(4) |
| Natural justice | Opportunity of hearing required | S.29(5) |
TDSAT Powers (Section 29(6))
The Appellate Tribunal may:
- Confirm the order or direction
- Modify the order or direction
- Set aside the order or direction
The 60-day limitation is strict. While condonation is possible under Section 29(3), practitioners should file well within time. Document receipt date carefully — this starts the clock.
Section 30: Execution as Decree
"An order passed by the Appellate Tribunal shall be executable by it as a decree of a civil court..."
— Section 30, DPDPA 2023TDSAT orders are directly executable — no need for separate civil court proceedings. This ensures swift enforcement of appellate decisions.
6.20 Further Appeal to Supreme Court
Section 29(7): Supreme Court Appeal
"Any person aggrieved by any decision or order of the Appellate Tribunal may file an appeal to the Supreme Court within sixty days from the date of communication of the decision or order... on any one or more of the grounds specified in section 100 of the Code of Civil Procedure, 1908."
— Section 29(7), DPDPA 2023Section 100 CPC Grounds (Substantial Questions of Law):
- Question of law of general importance
- Decision contrary to or in disregard of law or binding precedent
- Substantial error or defect in procedure affecting case merits
Unlike TDSAT appeal (which can review facts), Supreme Court appeal is limited to substantial questions of law. Factual findings by DPB/TDSAT are generally binding unless perverse or without evidence.
6.21 Alternate Dispute Resolution (Section 31)
Section 31: Mediation
"In the course of any proceeding before the Board or the Appellate Tribunal, if the Board or the Appellate Tribunal, as the case may be, is of the opinion that the matter could be resolved through mediation, it may direct the parties concerned to attempt to settle the dispute through such mediation..."
— Section 31, DPDPA 2023Key Features:
- Discretionary: Board/TDSAT decides if mediation appropriate
- Mediation Act 2023: Process governed by Mediation Act provisions
- Settlement effect: Treated as award under Mediation Act
Mediation can resolve disputes faster and with less reputational damage than full adjudication. Consider proposing mediation early, especially for complaints involving genuine misunderstandings rather than systemic violations.
6.22 Voluntary Undertaking (Section 32)
Section 32 provides a powerful mechanism to avoid penalties — the voluntary undertaking. A person can offer commitments to the Board, which if accepted, bars penalty proceedings.
Section 32: Mechanism
Initiation (S.32(1))
Person against whom proceedings under S.28 are instituted may give voluntary undertaking to the Board
Undertaking Contents (S.32(2))
May include: remediation actions, compliance timeline, monitoring mechanisms, compensation to affected persons
Board Acceptance (S.32(4))
If Board accepts, it constitutes a bar on penalty proceedings regarding undertaking contents
Variation (S.32(3))
Board may vary terms with consent of undertaking giver
Section 32(5): Breach Consequences
If a person fails to adhere to undertaking terms, such breach is deemed to be a breach of DPDPA itself. The Board may then proceed to impose penalties under Section 33. Schedule Item 6 makes the penalty "up to the extent applicable for the breach in respect of which proceedings were instituted."
Strategic Considerations
| Voluntary Undertaking | Full Adjudication |
|---|---|
| ✅ Avoids penalty if complied | ❌ Penalty risk |
| ✅ Faster resolution | ❌ Lengthy proceedings |
| ✅ Less publicity | ❌ Public order |
| ❌ Requires genuine commitment | ✅ Can challenge on merits |
| ❌ Breach triggers full penalty | ✅ One-time determination |
Voluntary undertakings work best when: (1) the breach is acknowledged, (2) remediation is feasible, (3) client has resources to implement commitments, and (4) reputational benefit of avoiding public penalty order outweighs operational burden of undertaking compliance.
6.23 Blocking Powers (Section 37)
For repeat offenders, DPDPA provides an ultimate sanction — blocking access to the Data Fiduciary's services.
Section 37: Conditions
- Board reference: Board intimates penalty imposition in two or more instances
- Board advice: Board advises blocking in interests of general public
- Central Government satisfaction: Necessary/expedient in public interest
- Hearing required: Opportunity of hearing to Data Fiduciary
- Recorded reasons: Reasons must be recorded in writing
Blocking Effect
The order directs any agency of Central Government or any intermediary to block public access to information enabling the Data Fiduciary to offer goods/services to Indian Data Principals.
Blocking is the most severe sanction — effectively terminating business in India. It's reserved for serial violators who demonstrate persistent disregard for data protection. Intermediaries receiving such orders are bound to comply (S.37(2)).
6.24 Good Faith Protection (Section 35)
"No suit, prosecution or other legal proceedings shall lie against the Central Government, the Board, its Chairperson and any Member, officer or employee thereof for anything which is done or intended to be done in good faith under the provisions of this Act..."
— Section 35, DPDPA 2023This protects:
- Central Government
- The Board
- Chairperson and Members
- Officers and employees
from liability for good faith actions under DPDPA. Malicious or mala fide actions are not protected.
🎯 Key Takeaways
- TDSAT is appellate forum: 60 days to appeal DPB orders
- Supreme Court limited to law: Only substantial questions of law under S.100 CPC
- ADR available: Mediation may be directed by Board/TDSAT
- Voluntary undertaking avoids penalty: But breach triggers full penalty exposure
- Blocking for repeat offenders: Ultimate sanction after 2+ penalties
- Good faith protection: Section 35 shields officials acting in good faith