IndiaDigital Personal Data Protection Act, 2023, Data Protection Board and penalties
In force since , under challenge in court.
An enforcement supervision rule binding public and private bodies.
- Private right of action
- No
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- An app processing Indian personal data, including biometric identifiers, answers only to the Data Protection Board of India: the civil courts have no jurisdiction over a matter the Board is empowered to decide, and the Act arms no private plaintiff.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Under challenge
- Yes
- Open questions
- What makes a breach 'significant' within section 33(1), the finding on which the power of the Board to impose a monetary penalty turns?
- What does it mean for the Board to 'function as an independent body' under section 28(1) when the Central Government appoints its Chairperson and Members under section 19(2) and each holds office 'for a term of two years' under section 20(2)?
What it makes you log
Logging duty
Sections 18 to 26 constitute the Data Protection Board and its members, and section 33 and the Schedule set the monetary penalties. Section 39 bars civil courts from matters the Board is empowered to decide. None of the cited sections requires a Data Fiduciary to keep a log or a record. The Board's powers of inquiry and of inspecting data, books and registers are in section 28, which this row does not cite.
- Kind
- None
- As of
What this law does
The Data Protection Board of India (Chapter VI, ss.18-26) is established and administratively operational, and section 39's ouster of civil-court jurisdiction over any matter the Board is empowered to decide is also in force, both since under Notification G.S.R. 843(E), clause (a).
Its penalty powers, set out in the Schedule under s.33(1), are exclusively civil monetary: up to Rs 250 crore for a failure to take reasonable security safeguards, up to Rs 200 crore for failing to notify a breach, up to Rs 200 crore for a children's-data violation, up to Rs 150 crore for a Significant Data Fiduciary violation, and up to Rs 10,000 for a data principal's own breach of their s.15 duties (impersonation, suppressing material information, frivolous complaints).
No provision found authorizes the Board to award compensation to an affected data principal directly; its penalties are payable to government. Section 33 (the penalty Schedule) and the rest of the complaint and appeal machinery (ss.27-34, except s.27(1)(d)) have not commenced; Notification G.S.R. 843(E), clause (c), appoints eighteen months from its own publication date, , as their commencement date.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .