India

Data Protection Board of India (DPBI) is an independent regulatory authority established under Section 19 of the Digital Personal Data Protection (DPDP) Act, 2023. Being a quasi-judicial authority, the DPBI acts as the privacy regulator of India. The DPBI is made in such a way that it works as 'digital by design' as compared to other traditional regulatory authorities. The DPBI is a digital office where everything happens through digital portals like receiving complaints, conducting hearing, analyzing evidence, issuing order and all others. The DPBI comprises a chairperson and some essential members who are appointed by the Central Government. These are people having expertise in data governance, law, information technology, and public administration. India is in Phase 1 of the 18 month phase implementation plan of the Digital Personal Data Protection (DPDP) Act, 2023. After the notification of the Digital Personal Data Protection Rules on November 13, 2025, the government announced a phased implementation schedule in order to ensure smooth transition of the enterprises. The complete compliance and enforcement of penalty will only come into effect from May 13, 2027.

The DPBI’s primary duties include ensuring adherence to the data protection laws and safeguarding the privacy rights of the citizens in the digital space. The key functions performed by it are: Adjudication of Grievances: Addressing grievances received from the individuals who feel that their privacy rights with respect to the use of their data have been infringed by the organization. Investigation of Data Breaches: Undertaking formal investigations of data breaches, any unauthorized access, or other processing errors that organizations report or the commission identifies through complaints. Direction Issuance: Issuing binding orders to organizations to implement immediate steps to prevent ongoing threats to the safety of data or resolve non-compliance. Monetary Penalty: Levying huge financial penalties, with maximum limits at ₹250 crore per incident, against organizations that do not ensure the protection of user data or follow the DPDP framework.