Who enforces the DPDP Act?
The Data Protection Board of India enforces the Act. It inquires into personal data breaches and complaints, may direct urgent remedial or mitigation measures, and can impose financial penalties in accordance with the Schedule. Its proceedings are digital by design, and its orders are appealable.
A Data Principal is generally expected to exhaust the Data Fiduciary's own grievance mechanism before approaching the Board, which makes a functioning grievance route your first line of defence as well as an obligation.
The Board weighs matters such as the nature, gravity and duration of a breach and any mitigating action taken, so evidence that a real programme was operating is directly relevant to outcome.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Jupinder Bedi — Jupinder writes on data protection practice at ProtectComply, with a focus on how obligations translate into system behaviour.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →