How to appeal a DPDP penalty: the Data Protection Board process
The Data Protection Board has the power to impose substantial penalties. Here is how the adjudication process works and how to appeal a penalty order if you disagree.
What powers does the Data Protection Board of India have under DPDP?
The Data Protection Board of India is constituted under Chapter VII of the DPDP Act. It has the power to receive complaints from data principals, conduct inquiries into alleged violations by Data Fiduciaries and Processors, call for information and documents, and impose financial penalties. The Board can also issue directions — requiring you to take specific remediation steps or to cease certain processing activities. It is not a criminal court; penalties are financial and regulatory, not custodial.
How does a DPDP inquiry by the Data Protection Board start?
An inquiry can be initiated in two ways: on a complaint from a data principal who believes their rights have been violated, or on the Board's own motion if it identifies a potential violation (for example, from media reports or intelligence from other regulators). Once an inquiry is initiated, the Board will notify you and give you an opportunity to present your case. The inquiry process is designed to be faster than court proceedings — a key design goal of the Act.
What happens at a Data Protection Board hearing for a DPDP violation?
Before the Board makes any penalty order, it must give you a reasonable opportunity to be heard. This means you can submit a written response to the allegations, request a hearing, present evidence, and make legal arguments. If you receive a show-cause notice from the Board, treat it with urgency — respond promptly, engage experienced privacy counsel, and put together a comprehensive defence. Document everything: your compliance measures, your consent records, your breach response if a breach was involved, and any remediation steps you have already taken.
What factors does the Data Protection Board consider when setting DPDP penalties?
The Act directs the Board to consider several factors when determining the penalty quantum: the severity and nature of the violation; the number of data principals affected; the type of personal data involved; whether the violation was deliberate or negligent; whether you took steps to mitigate harm; whether you cooperated with the Board; and your history of prior violations. Strong compliance documentation, evidence of good-faith remediation, and transparent cooperation with the Board can all influence the penalty in your favour.
How do you appeal a DPDP penalty order to TDSAT?
If you disagree with the Board's penalty order, you can appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 30 days of the order. An appeal does not automatically stay the penalty — you may need to apply for a stay. To file an appeal, you must typically deposit the penalty amount (or part of it, at the Tribunal's discretion) while the appeal is pending. TDSAT will review the Board's order on questions of fact and law. Further appeal from TDSAT lies to the appropriate High Court on questions of law.
Should you voluntarily disclose a DPDP violation to the Data Protection Board?
The best outcome is never reaching the penalty stage. If you discover a potential violation — a breach you should have reported but did not, a consent gap you have now remediated — consider whether voluntary disclosure to the Board makes sense. Regulators in most jurisdictions treat voluntary self-disclosure more favourably than violations discovered through complaints or investigations. Consult your privacy counsel before making any proactive disclosure, but do not assume silence is always the safest option.
Frequently asked questions
Can the Board impose penalties without giving us a hearing?
No. The DPDP Act explicitly requires that the Board give the Data Fiduciary or Processor an opportunity to be heard before imposing any penalty. Proceeding to a penalty order without a fair hearing would be a breach of natural justice and grounds for appeal. If you receive a notice of inquiry, ensure you respond within the timeframe specified and request a hearing if you wish to present your case orally.
What is the maximum penalty under the DPDP Act?
The maximum penalty for a single violation is ₹250 crore. Specific breach notification failures carry penalties up to ₹200 crore; failures to implement adequate security safeguards also carry up to ₹200 crore; other violations attract lower caps. Penalties can be imposed per violation, so a systemic failure affecting many data principals could lead to aggregate penalties exceeding any single cap.
If we appeal to TDSAT, do we have to pay the penalty while the appeal is pending?
Typically yes, or at least deposit the amount — but you can apply for a stay of the penalty order while the appeal is pending. The TDSAT will decide whether to grant a stay based on the apparent merits of the appeal and the risk of harm from non-payment. Engaging experienced counsel early in the process is important if you intend to appeal and want a stay of execution.
Build your compliance defence before you need it
Niti Bharat's DPDP Readiness Assessment gives you the documentation, consent records, and compliance evidence that will form your defence in a Board inquiry — built before you need it.
Start DPDP Readiness Assessment