DPDP reference

Section 27: Powers and functions of Board

Last checked 6 Nov 2026

On a breach intimation under s.8(6) the Board may direct urgent remedial or mitigation measures, inquire and impose a penalty (s.27(1)(a)). It also acts on a Data Principal's complaint, a reference from the Central or a State Government, or a court's direction (s.27(1)(b)), and on complaints and intimations about Consent Managers (s.27(1)(c) and (d)), and on a reference about an intermediary under s.37(2) (s.27(1)(e)).

After a hearing and with written reasons the Board may issue binding directions (s.27(2)), and may modify, suspend, withdraw or cancel a direction on representation or reference (s.27(3)).

Applies to
Data Fiduciaries, Consent Managers and intermediaries that come before the Board.
Starts
s.27(1)(d): 13 Nov 2026 (G.S.R. 843(E), item (b)). The rest of s.27: 13 May 2027 (G.S.R. 843(E), item (c)).
Penalty
Failure to follow a direction falls under breach of any other provision, up to ₹50 crore (s.33, Schedule item 7).
Source
Digital Personal Data Protection Act, 2023 (22 of 2023), section 27; G.S.R. 843(E), commencement

Questions

Can the Board order urgent steps after a breach?

Yes. On receipt of a breach intimation it may direct urgent remedial or mitigation measures (s.27(1)(a)).

Related

Next

Join early access

Not legal advice.