Procedure to be followed by Board
Section 28 of the Digital Personal Data Protection Act, 2023 deals with procedure to be followed by Board. The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be pre The Act was enacted on 11 Aug 2023.
(1) The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed.
(2) The Board may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder.
(3) The Board shall determine whether there are sufficient grounds to proceed with an inquiry.
(4) In case the Board determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings.
(5) In case the Board determines that there are sufficient grounds to proceed with inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any person for ascertaining whether such person is complying with or has complied with the provisions of this Act.
(6) The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry.
(7) For the purposes of discharging its functions under this Act, the Board shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908 (5 of 1908), in respect of matters relating to---
(a) summoning and enforcing the attendance of any person and examining her on oath;
(b) receiving evidence of affidavit requiring the discovery and production of documents;
(c) inspecting any data, book, document, register, books of account or any other document; and
(d) such other matters as may be prescribed.
(8) The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person.
(9) The Board may require the services of any police officer or any officer of the Central Government or a State Government to assist it for the purposes of this section and it shall be the duty of every such officer to comply with such requisition.
(10) During the course of the inquiry, if the Board considers it necessary, it may for reasons to be recorded in writing, issue interim orders after giving the person concerned an opportunity of being heard.
(11) On completion of the inquiry and after giving the person concerned an opportunity of being heard, the Board may for reasons to be recorded in writing, either close the proceedings or proceed in accordance with section 33.
(12) At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant.
Section 28, The Digital Personal Data Protection Act, 2023 (Act 22 of 2023).
Cross-references
Extracted from the operative text of the enactments themselves. Every destination below exists in our corpus.
This section refers to
Referred to by 2
Made under this section, and citing it
1 instrument names this provision in its title or its text without being made under it.
Questions about Section 28
What does Section 28 of the Digital Personal Data Protection Act deal with?
Section 28 of the Digital Personal Data Protection Act is headed "Procedure to be followed by Board". The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be pre
How do I find court cases under Section 28 of the Digital Personal Data Protection Act?
In judgments and charge sheets this section is written several ways, and each form finds a different set of orders. These search the full text of every order eCourtsIndia holds, best matches first: Digital Personal Data Protection Act 28, section 28 Digital Personal Data Protection Act, section 28 of the Digital Personal Data Protection Act. Each opens the full list of orders on eCourtsIndia, where it can be narrowed by court, year and outcome.
What should I read with Section 28 of the Digital Personal Data Protection Act, and has it changed?
Its own text turns on section 27 (Powers and functions of Board), section 33 (Penalties), so none of them can safely be read on its own. 2 other provisions in this corpus refer back to it. One instrument names it without being made under it, most recently Enforcement Timeline for the DPDP Act (2025).
When was Section 28 of the Digital Personal Data Protection Act enacted?
Section 28 of the Digital Personal Data Protection Act, cited as Digital Personal Data Protection Act 28, was enacted on 11 Aug 2023 as Act 22 of 2023. It is in force as at the date shown on this page.
Other sections of this Act
- 6. Consent818 words
- 17. Exemptions716 words
- 2. Definitions713 words
- 7. Certain legitimate uses684 words
- 8. General obligations of Data Fiduciary637 words
- 40. Power to make rules613 words
Source and method. Compiled from the enactments of Parliament and of the State legislatures as published on India Code, and republished together with commentary and other original matter under section 52(1)(q)(ii) of the Copyright Act, 1957. Structured, cross-referenced and maintained by eCourtsIndia. Text as in force on 18 Oct 2026. This page is not a substitute for legal advice.