How to File a Privacy Complaint with the Data Protection Board
• The Authority: The Data Protection Board of India (DPBI), established under the DPDP Act 2023, is the central body for adjudicating privacy violations.
• The Pre-requisite: You must first exhaust the internal grievance mechanism of the company (Data Fiduciary) before escalating to the Board.
• The Timeline: Under the 2025 Rules, companies have a limited window—often 7 days—to respond to your privacy concerns.
• The Penalty: Serious violations can attract financial penalties up to ₹250 crore, making this a powerful tool for consumer protection.
The Digital Personal Data Protection (DPDP) Act, 2023, has fundamentally altered the power dynamic between Indian citizens and data-hungry corporations. As we move through the 2026 phased rollout, the "soft enforcement" period has ended, and the Data Protection Board of India (DPBI) is now actively entertaining complaints. This guide explains how to navigate the two-tiered process of reclaiming your digital privacy.
Step 1: The "Company First" Approach
You cannot approach the DPBI directly for a fresh grievance. The law requires you to first give the "Data Fiduciary" (the company) a chance to fix the issue. Every company operating in India is now legally mandated to publish the contact details of a Grievance Officer.
Actionable Step: Send a formal, written email to the Grievance Officer. Clearly state which right has been violated (e.g., Right to Correction, Right to Erasure, or withdrawal of consent). Under the DPDP Rules 2025, companies are expected to acknowledge and ideally resolve these within 7 days. Ensure you keep a copy of this correspondence and any automated acknowledgments.
Step 2: Escalating to the DPBI Portal
If the company fails to respond within the prescribed period, or if the resolution is unsatisfactory, you can escalate the matter to the DPBI. The Board operates on a "digital office" model, meaning the entire process is paperless.
Implementation Steps:
• Register: Visit the official portal at www.dpb.gov.in and create a "Data Principal" account.
• File the Complaint: Complete the online form on the DPBI website. You will need to specify the nature of the breach—whether it was a failure to provide notice, unauthorized processing, or a personal data breach.
• Upload Evidence: This is critical. Attach your initial email to the company's Grievance Officer and their response (or lack thereof).
• Fee Payment: A nominal fee (currently ₹500) is required for filing, though exemptions exist for vulnerable groups.
Step 3: Adjudication and Inquiry
Once filed, the DPBI will assign a complaint number within 15 days. As a quasi-judicial body, the Board has the power to summon company representatives and conduct a detailed inquiry. Unlike traditional courts, the DPBI's process is designed to be time-bound and digital-first. If the Board finds a "significant" breach, it can issue directions for data deletion or impose substantial financial penalties.
Step 4: The Appeals Pathway
If you are dissatisfied with the DPBI’s final order, the legal journey doesn't end. You have 60 days to file an appeal with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Further appeals on specific questions of law can be taken to the Supreme Court of India, ensuring that your digital rights are anchored in constitutional oversight.
Comments ()