What happens after you file a data privacy complaint? How the Data Protection Board investigates

At a glance

The Data Protection Board first decides whether there are sufficient grounds to inquire. If there aren’t, it records why and closes the matter. If there are, it runs an inquiry — digitally, following natural justice, with power to summon people and documents — and can issue interim orders along the way. Not every case runs to a full penalty: the Board can direct the parties to mediation, or accept a binding undertaking from the company. A case ends either with the proceedings closed or with penalties imposed.

Educational resource only. This explains how the Data Protection Board handles a complaint under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

First: does the Board even take up your complaint?

Before anything else, the Board decides whether your complaint is worth an inquiry — it’s a filter, not an automatic trigger. On receiving a complaint, a breach report, or a government reference, the Board examines whether there are sufficient grounds to proceed (Section 28).

If it decides there aren’t, it must record its reasons in writing and close the matter — it can’t quietly ignore you, but it can decline with an explanation. If it decides there are, the inquiry begins. This is also where a complaint that skipped the business-first grievance step, or that looks frivolous, can fall away — which is why a clear, evidenced complaint matters so much.

What an inquiry actually involves

An inquiry is a structured, court-like process run online — fair hearing on both sides, with real investigative power. Three features define it:

• Natural justice. The company gets a fair chance to respond and be heard before any adverse finding. So does the Board’s process cut both ways — it isn’t a rubber stamp for complainants.
• Investigative teeth. For the purposes of the inquiry the Board has powers of a civil court — it can summon individuals, require them to give evidence, and call for documents. A business can’t stonewall it.
• Interim orders. If circumstances demand it, the Board can — for reasons recorded in writing, and after hearing the person concerned — issue interim orders while the inquiry continues, for example to contain an ongoing harm.

And it runs as a digital office: hearings by audio-visual link, physical presence only where the Board thinks it’s genuinely necessary.

Can it be settled without a full inquiry?

Yes — the Act builds in two off-ramps, so not every complaint ends in a penalty fight. The Board can steer a matter to a resolution instead of a ruling:

• Mediation (Section 31). If the Board thinks a complaint could be resolved by agreement, it can direct the parties to attempt mediation — through a mediator they agree on, or one provided under law. Useful where the fix is practical rather than punitive.
• Voluntary undertaking (Section 32). At any stage, the Board can accept a binding promise from the company to do — or stop doing — something. Accepting it generally bars further proceedings on that matter. But it has bite: if the company breaks the undertaking, that breach is itself treated as a breach of the Act, and the Board can move to penalties.

How a case ends

Every inquiry closes one of two ways: proceedings closed, or enforcement under the penalty provisions. After completing the inquiry and hearing the person concerned, the Board — again recording its reasons — will either:

• close the proceedings, if no action is warranted; or
• proceed to enforcement under the Act’s penalty provisions (Section 33), where it can impose financial penalties scaled to the breach.

Whichever way it goes, the reasoning is written down — which also gives either side the basis to appeal (covered in the enforcement piece).

What you can expect as the complainant

You’re the trigger and a witness — but the case is the Board’s, and the outcome isn’t a personal payout. Two expectation-setters worth being honest about:

• You don’t “run” the case. Once you’ve complained, the Data Protection Board drives the inquiry. You may be asked for information, but you’re not litigating it like a plaintiff in court.
• A win penalises the company; it doesn’t pay you. Penalties go to the Consolidated Fund of India — the government’s account — not to affected individuals. The value to you is accountability and a company forced to comply, not compensation.

FAQ