On this page
A customer who is unhappy with how you handled her data can use your grievance process and then complain to the Data Protection Board. Either side can appeal what the Board decides. This page walks through that path in order, for a person who wants to complain and for a business that wants to know what a complaint leads to. It covers the Act, the Rules and the commencement notification only. The sections on the law are cited in the Sources box. The section marked Our view is our opinion and carries no citation.
The short answer
A Data Principal must first use the business’s grievance process, which has a published response period of no more than 90 days. Only then can she complain to the Board. The Board decides whether there are sufficient grounds. If there are, it inquires, hears the business and may impose a penalty, but only for a breach it finds significant. Anyone aggrieved by an order or direction of the Board can appeal to the Appellate Tribunal within 60 days of receiving it. The Board’s complaint and inquiry powers start on 13 May 2027.
The path, step by step
- Grievance to the business. The Data Principal raises the matter through the business’s grievance redressal system. The Act says she must exhaust that opportunity before she approaches the Board. The Rules require the business to publish a response period of no more than 90 days.
- Complaint to the Board. The Board is to work, as far as practicable, as a digital office, with complaints received and decisions pronounced digitally. It can also act on a personal data breach intimation, on a reference from the Central or a State Government, or on the directions of a court.
- A check for sufficient grounds. If the Board finds the grounds insufficient, it may close the proceedings and must record its reasons in writing. If it finds them sufficient, it may inquire into the affairs of any person to see whether the Act is being followed.
- The inquiry. The Board follows the principles of natural justice and records the reasons for what it does. It has the powers of a civil court to summon and examine people on oath, receive evidence by affidavit, call for documents and inspect records. It can issue interim orders after giving the business a chance to be heard.
- The outcome. After the inquiry and a hearing, the Board either closes the proceedings or moves to a penalty. It may also direct the parties to try mediation, and it may accept a voluntary undertaking from a business at any stage of the proceedings.
- An appeal, if either side wants one. See How the appeal works, below.
What the Board can act on
- An intimation of a personal data breach. The Board can direct urgent remedial or mitigation measures, inquire, and impose a penalty.
- A complaint by a Data Principal about a personal data breach, or about a business not meeting its obligations about her personal data or the exercise of her rights.
- A reference from the Central or a State Government, or the directions of a court.
- A complaint by a Data Principal about a Consent Manager, and an intimation that a Consent Manager has broken a condition of its registration (the power over a registration breach starts on 13 November 2026).
The Board may also give directions to a person after hearing them and recording its reasons, and that person must comply. Someone affected by a direction can make a representation, and the Board can then change, suspend, withdraw or cancel it.
Time limits
| What | The limit |
|---|---|
| Business responds to a grievance | Within the period it publishes, no more than 90 days |
| Board completes an inquiry | Six months from receiving the intimation, complaint, reference or direction. The Board can extend it for reasons recorded in writing, by up to three months at a time |
| Appeal against a Board order or direction | 60 days from receiving it. The Appellate Tribunal can accept a late appeal if it is satisfied there was sufficient cause |
| Tribunal decides the appeal | It is to try to dispose of it within six months of the appeal being presented, and must record its reasons if it does not |
How the appeal works
The Appellate Tribunal for the DPDP Act is the Telecom Disputes Settlement and Appellate Tribunal. The appeal is filed digitally, with a fee equal to the fee for an appeal under the Telecom Regulatory Authority of India Act, unless the Tribunal’s Chairperson reduces or waives it. The fee is paid digitally through UPI or another payment system the Reserve Bank of India authorises. The Tribunal is not bound by the Code of Civil Procedure and is guided by natural justice, and it can confirm, modify or set aside the order. Its orders can be executed as a decree of a civil court. The Act also says that a further appeal against a Tribunal order is dealt with under the Telecom Regulatory Authority of India Act. We did not check that Act, so this page does not describe it.
What if a complaint is false
At any stage after a complaint arrives, if the Board thinks it false or frivolous, it can issue a warning or impose costs on the complainant. A business facing a complaint it thinks is baseless should answer it on the facts and keep its records.
What this does not tell you
The parts of the Act that set up the Board have applied since 13 November 2025, but the Act fixes the date the Board is established by a separate notification. This page does not say whether that has happened, who sits on the Board, or where and how a complaint is filed. Look for official notices. The penalties article covers what the Board can fine, and the rights article covers the grievance step.
Our view: what to do now
Our view. This is the order we would work in. Apart from the dates set out above, it makes no claim about the law.
- Make the grievance step work. It is the step the Act puts first. Name who receives a grievance, how it is logged, and who replies.
- Log each complaint with dates. Record the day it arrived, what was asked, what you did and the day you answered. A clear record is what you would show an inquiry.
- Decide who handles Board notices. Name one person who reads them, and put the 60-day appeal clock on your calendar the day an order arrives.
- Keep your records ready. Your data record, your consent notice and your breach log are the documents an inquiry is likely to ask for.
The toolkit covers the grievance and breach steps. It does not file or defend a Board complaint.
Common questions
Can a person complain to the Data Protection Board straight away?
No. The Act says a Data Principal must exhaust the opportunity of redressing her grievance with the business before she approaches the Board. The business must publish a grievance response period of no more than 90 days.
How long does a Board inquiry take?
The Rules say the inquiry is to be completed within six months from the date the Board receives the intimation, complaint, reference or direction. The Board can extend that for reasons recorded in writing, by up to three months at a time.
Can a Board order be appealed, and by when?
Yes. Anyone aggrieved by an order or direction of the Board can appeal to the Appellate Tribunal within 60 days of receiving it. The Tribunal can accept a late appeal if it is satisfied there was sufficient cause.
Who hears the appeal, and how is it filed?
The Telecom Disputes Settlement and Appellate Tribunal. The appeal is filed digitally with a fee equal to the fee for an appeal under the Telecom Regulatory Authority of India Act, unless the Tribunal’s Chairperson reduces or waives it, paid through UPI or another payment system the Reserve Bank of India authorises.
What happens to a false or frivolous complaint?
At any stage after a complaint is received, the Board can issue a warning or impose costs on the complainant if it thinks the complaint false or frivolous.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 07: Answer people on time, in the toolkit
- How-to 11: When something goes wrong, in the toolkit
- The free duties list, every duty in plain words
Sources
Every section, rule and date above was checked against the official text on 7 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
Official text: the Digital Personal Data Protection Act, 2023 (MeitY, PDF)
- Section 2(a)Appellate Tribunal: the Telecom Disputes Settlement and Appellate Tribunal
- Section 13(3)A Data Principal must exhaust grievance redressal with the business before approaching the Board
- Section 18(1)The Board is established from a date the Central Government notifies
- Section 27(1) to (3)Powers and functions of the Board: breach intimations, complaints, references, Consent Manager matters, directions
- Section 28(1) to (12)Procedure: digital office, sufficient grounds, inquiry, natural justice, civil-court powers, interim orders, close or penalty, false or frivolous complaints
- Section 29(1) to (10)Appeal to the Appellate Tribunal within sixty days; sufficient cause; six months; digital office
- Section 30Orders of the Appellate Tribunal executable as a decree of a civil court
- Section 31Mediation
- Section 32Voluntary undertaking
- Section 33(1) and (2)Penalty only if an inquiry finds a breach significant, after a hearing; matters the Board considers
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 1(4)Rules 3, 5 to 16, 22 and 23 in force eighteen months from publication
- Rule 14(3)A published grievance response period of no more than ninety days
- Rule 19(9)The inquiry is completed within six months, extendable for reasons in writing by up to three months at a time
- Rule 20The Board functions as a digital office
- Rule 22(1) to (3)Appeal to the Appellate Tribunal: digital filing, fee, payment by UPI or another authorised system, procedure
Notifications
Official text: commencement notification G.S.R. 843(E) (MeitY, PDF)
- G.S.R. 843(E), clause (a)Sections 18 to 26 in force on 13 November 2025
- G.S.R. 843(E), clause (b)Sections 6(9) and 27(1)(d) in force one year from 13 November 2025
- G.S.R. 843(E), clause (c)Sections 3 to 5, 6 (except 6(9)), 7 to 17, 27 (except 27(1)(d)), 28 to 34, 36, 37 and 44(2) in force eighteen months from 13 November 2025
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
