In simple words
The Board can direct urgent steps after a breach, inquire into breaches and complaints, and impose penalties. It also handles breaches by Consent Managers and of their registration conditions, and references about intermediaries. It can issue directions and modify or suspend them.
- What this means for you
- Once in force, you can complain to the Board about a breach or a company not honouring your rights.
- What this means for businesses
- The Board can order urgent remedial measures after a breach. Its inquiry and penalty powers start on 13 May 2027, except clause (1)(d) on Consent Managers, which starts on 13 November 2026.
- Everyday example
- After a reported leak at an online store, the Board could direct it to reset passwords and inform users.
Who it applies to
The Board; Data Fiduciaries, Consent Managers and intermediaries subject to its powers.
Related Rules
- Rule 4. Registration and obligations of Consent Manager From 13 November 2026
- Rule 7. Intimation of personal data breach From 13 May 2027
Related sections
Official textas notified
Source: MeitY copy of the Gazette (CG-DL-E-12082023-248045), page 14. Printed dashes are shown as colons; the wording is unchanged.
(1) The Board shall exercise and perform the following powers and functions, namely:
(a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;
(b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;
(c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act;
(d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and
(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act.
(2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same.
(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.