What is the Data Protection Board of India?

The Data Protection Board of India is the regulator created under the DPDP Act to enforce it — it investigates complaints, directs businesses to fix problems, and imposes penalties. It’s the body an individual ultimately turns to when a business won’t resolve a data-protection grievance.

Educational resource only — not legal advice.

Established under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the Board (sometimes called the DPBI) is designed to work as a digital office — complaints can be filed and tracked online. It can inquire into breaches, order urgent remedial or mitigation measures, and levy the Act’s financial penalties, which run up to ₹250 crore.

Why it matters to you. For an individual, the Board is where a complaint goes after you’ve exhausted the business’s own grievance channel. For a business, it’s the authority that will assess a breach and decide any penalty — so how you cooperate and mitigate matters.

What it is not. The Board is not a Consent Manager, and not an ordinary court — it’s the specialist regulator for the DPDP Act, and you’re generally expected to use a business’s grievance channel before approaching it.