Section 27 of Digital Personal Data Protection Act, 2023 - Powers and Functions of Board
Section 27 of the Digital Personal Data Protection Act, 2023 (DPDP Act) sets out the principal enforcement powers and functions of the Data Protection Board of India. It identifies when the Board may inquire into a breach, direct urgent remedial or mitigation measures, impose penalties under the Act and issue binding directions.
What Section 27 Covers
- Personal data breach intimations and urgent remedial or mitigation directions.
- Complaints by a Data Principal against a Data Fiduciary concerning a breach, statutory obligations or exercise of rights.
- Complaints concerning a Consent Manager and breach of its obligations or registration conditions.
- References from the Central Government, State Government or directions of a court in the circumstances specified by the Act.
- Binding directions issued by the Board after hearing the person concerned and recording reasons in writing.
- Power to modify, suspend, withdraw or cancel a direction, subject to conditions.
Section 27 - Statutory Text
(1) The Board shall exercise and perform the following powers and functions, namely:-
(a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;
(b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;
(c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act;
(d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and
(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 37 by an intermediary, to inquire into such breach and impose penalty as provided in this Act.
(2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same.
(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.
For authoritative wording, refer to the official DPDP Act, 2023 published by the Ministry of Electronics and Information Technology.
Meaning of Important Terms Used in Section 27
Board
The "Board" means the Data Protection Board of India established by the Central Government under Section 18 of the DPDP Act. The Board was established by notification issued in November 2025.
Data Principal
Under Section 2, a "Data Principal" is the individual to whom the personal data relates. Where that individual is a child, the expression includes the parents or lawful guardian; where the individual is a person with disability, it includes the lawful guardian acting on her behalf.
Data Fiduciary
A "Data Fiduciary" is any person who alone or in conjunction with other persons determines the purpose and means of processing personal data.
Consent Manager
A "Consent Manager" is a person registered with the Board who enables a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. The final Digital Personal Data Protection Rules, 2025 provide the implementation framework for registration and obligations of Consent Managers.
Personal Data Breach
A "personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.
How the Board's Powers Under Section 27 Operate
Section 27 does not create an unrestricted power to begin proceedings in every situation. Sub-section (1) identifies specified triggers for the Board's jurisdiction, including breach intimations, complaints, government references, court directions and specified Consent Manager or intermediary matters. The nature of the trigger determines the inquiry the Board may undertake.
Sub-section (2) adds a procedural safeguard before the Board issues directions for effective discharge of its functions. The person concerned must be given an opportunity of being heard, and the Board must record reasons in writing. A direction issued in accordance with the provision is binding on the person to whom it is addressed.
Sub-section (3) gives the Board continuing control over its directions. On a representation by an affected person, or on a reference from the Central Government, the Board may modify, suspend, withdraw or cancel a direction and may impose conditions governing that action.
Related Provisions and 2025 Rules
Section 27 should be read with Section 28 on procedure to be followed by the Board, Section 29 on appeals to the Appellate Tribunal, and the provisions dealing with penalties and voluntary undertakings. The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and contain the detailed implementation framework, including provisions concerning the Board and Consent Managers.
Practical Significance of Section 27
Section 27 is central to the enforcement structure of the DPDP Act because it connects statutory obligations and rights with the Board's inquiry, direction and penalty functions. Its application, however, must be read with the phased commencement notification. For any compliance or proceeding, check which provision has actually come into force on the relevant date.