Enforcement and your action plan
The Board, penalties, and the road to May 2027
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
The Data Protection Board of India
The Board is an independent body set up in November 2025. It works as a digital office, from complaint to hearing to order.
The Board was constituted with effect from 13 November 2025 and is based in the National Capital Region. It is not a rule-maker: rules come from the Central Government. Its job is adjudication and enforcement.
How a case moves
Most cases start with a complaint or a breach report. You get a hearing before any penalty, and you can appeal within 60 days.
A reference can come from the Central or State Government, or a court direction. The Board can close a case at the inquiry stage if there are insufficient grounds, and can impose costs on frivolous complainants.
Maximum penalties per instance
Penalties can reach ₹250 crore per instance. The Board sets the amount based on how serious the breach was and how you responded.
Factors in s.33(2): nature, gravity and duration; type and nature of data; repetitive nature; gain made or loss avoided; mitigation steps and their timeliness; proportionality; and likely impact of the penalty. Penalties go to the Consolidated Fund of India, not to the affected people. The Act has no criminal offences of its own. Breaking a voluntary undertaking is penalised up to the amount that applied to the breach the original proceedings were about (Schedule, item 6). A penalty is imposed only where the Board finds the breach significant (s.33(1)).
Two more tools
You can offer the Board a promise to fix a problem, and that can close the case. Repeat offenders risk having their platform blocked in India.
An undertaking can include specific actions within a set time, or a promise not to do something. The Board may publish it. Blocking under s.37 requires a reference from the Board and a Government decision, after giving the fiduciary a hearing.
Your 10-step action plan
Here is a practical plan. Start with the data map: every other step depends on knowing what you hold.
A sensible order for most organisations: steps 1 and 2 in the first quarter, steps 3 to 7 in the next two quarters, and testing and evidence in the final months before May 2027. If you might become an SDF, plan for a shorter runway.
Before you act
Laws change and details matter. Use this series to understand the shape of the law, then check the official text and get advice.
Sources: the Digital Personal Data Protection Act, 2023 (No. 22 of 2023); the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025); and the commencement notifications issued the same day.
In one line
That's the DPDP Act and Rules, end to end. Thanks for watching.