Data Protection Board of India (DPBI)
Definition
The adjudicatory body established by the DPDP Act to receive complaints, investigate breaches of the Act, and impose penalties. The Board operates as an independent body and can direct remediation as well as impose financial penalties up to INR 250 crore per instance.
- Law
- Established by the DPDP Act
- Function
- Receives complaints, investigates breaches
- Status
- Independent adjudicatory body
- Maximum penalty
- Up to INR 250 crore per instance
Common questions
How does the DPBI's role differ from that of a court in a data-breach dispute?+
The DPBI is an administrative adjudicatory body that investigates breaches, directs remediation, and imposes financial penalties within the DPDP Act's framework, whereas civil or criminal courts would handle separate claims such as tort damages or offences under other statutes; the two forums can operate in parallel on the same underlying incident.
What determines whether a penalty imposed by the DPBI reaches the maximum INR 250 crore figure?+
The Act ties penalty severity to the nature and gravity of the breach, so the ceiling represents the upper bound for the most serious violations rather than a standard fine, and the Board has discretion to impose lower amounts scaled to the specific failure, harm caused, and the fiduciary's response.
Related terms
- Consent Notice
- A notice that must be provided to the data principal before or at the time of requesting consent. It must be clear,...
- Data Fiduciary
- The term used in India's Digital Personal Data Protection Act 2023 for an entity that determines the purpose and means of processing...
- Data Principal
- The individual to whom the personal data relates. Equivalent to the data subject under GDPR. The DPDP Act grants data principals rights...
- Data Processor
- An entity that processes personal data on behalf of a data fiduciary, under the fiduciary's instructions. Equivalent to the data processor under...
- Significant Data Fiduciary (SDF)
- A data fiduciary designated by the central government as carrying elevated risk based on data volume, sensitivity, national security considerations, or impact...