DPDP reference
Section 28: Procedure to be followed by Board
Last checked 6 Nov 2026
The Board works as an independent body and, as far as practicable, as a digital office (s.28(1)). It decides whether there are sufficient grounds for inquiry, closing the matter with written reasons where there are not (s.28(3) and (4)). An inquiry follows natural justice (s.28(6)), with civil court powers over summons, evidence and inspection of documents (s.28(7)).
The Board may not prevent access to premises or take custody of equipment or an item in a way that may adversely affect a person's daily functioning (s.28(8)). It may issue interim orders after a hearing (s.28(10)), and at the end either close the proceedings or move to s.33 (s.28(11)). A false or frivolous complaint may bring a warning or costs (s.28(12)).
- Applies to
- Any person under inquiry, and any Data Principal who complains.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- None of its own. This section sets out how the law works and places no duty on a business.
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 28; G.S.R. 843(E), commencement
Questions
Can the Board inspect documents?
Yes. It has civil court powers including inspecting any data, book, document, register or books of account (s.28(7)(c)).
What happens to a false complaint?
The Board may issue a warning or impose costs on the complainant (s.28(12)).
Related
Next
Not legal advice.