Section 28 of Digital Personal Data Protection Act, 2023 - Procedure to be Followed by Board
Section 28 of the Digital Personal Data Protection Act, 2023 (DPDP Act) lays down the procedure that the Data Protection Board of India must follow while dealing with intimations, complaints, references, directions and inquiries under the Act. It combines a digital-by-design adjudicatory process with safeguards such as natural justice, recorded reasons and an opportunity of hearing.
Meaning and scope of Section 28
Section 28 is the principal procedural provision governing how the Board conducts proceedings under Chapter VI of the DPDP Act. It should be read with Section 27, which sets out the powers and functions of the Board, and with the Digital Personal Data Protection Rules, 2025. The provision covers the threshold decision whether an inquiry should proceed, the manner of inquiry, evidentiary and civil-court-type powers, interim orders, final action and treatment of false or frivolous complaints.
Section 28 - statutory provision
(1) The Board shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed.
(2) The Board may, on receipt of an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27, take action in accordance with the provisions of this Act and the rules made thereunder.
(3) The Board shall determine whether there are sufficient grounds to proceed with an inquiry.
(4) In case the Board determines that there are insufficient grounds, it may, for reasons to be recorded in writing, close the proceedings.
(5) In case the Board determines that there are sufficient grounds to proceed with inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any person for ascertaining whether such person is complying with or has complied with the provisions of this Act.
(6) The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry.
(7) For the purposes of discharging its functions under this Act, the Board shall have the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in respect of matters relating to-
(a) summoning and enforcing the attendance of any person and examining her on oath;
(b) receiving evidence of affidavit requiring the discovery and production of documents;
(c) inspecting any data, book, document, register, books of account or any other document; and
(d) such other matters as may be prescribed.
(8) The Board or its officers shall not prevent access to any premises or take into custody any equipment or any item that may adversely affect the day-to-day functioning of a person.
(9) The Board may require the services of any police officer or any officer of the Central Government or a State Government to assist it for the purposes of this section and it shall be the duty of every such officer to comply with such requisition.
(10) During the course of the inquiry, if the Board considers it necessary, it may for reasons to be recorded in writing, issue interim orders after giving the person concerned an opportunity of being heard.
(11) On completion of the inquiry and after giving the person concerned an opportunity of being heard, the Board may for reasons to be recorded in writing, either close the proceedings or proceed in accordance with section 33.
(12) At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant.
How the Board proceeds under Section 28
1. Digital-by-design proceedings
Section 28(1) requires the Board, as far as practicable, to function as a digital office. Rule 19 of the Digital Personal Data Protection Rules, 2025 gives effect to this model by permitting the Board to conduct proceedings through techno-legal measures without requiring physical presence, while preserving its statutory power to summon and examine a person on oath where necessary.
2. Preliminary examination and sufficient grounds
After receiving a matter falling within Section 27(1), the Board must decide whether sufficient grounds exist to proceed with an inquiry. If sufficient grounds are absent, Section 28(4) permits closure, but the reasons must be recorded in writing. If sufficient grounds exist, Section 28(5) permits an inquiry into whether the person concerned is complying with, or has complied with, the DPDP Act.
3. Natural justice and reasoned action
Section 28(6) expressly requires the Board to follow the principles of natural justice and to record reasons for its actions during the inquiry. This procedural safeguard is reinforced by Sections 28(10) and 28(11), which require an opportunity of hearing before an interim order and before the Board closes the proceeding or proceeds under Section 33 at the conclusion of the inquiry.
4. Civil court powers
For specified procedural matters, Section 28(7) gives the Board powers equivalent to those vested in a civil court under the Code of Civil Procedure, 1908. These include summoning and enforcing attendance, examination on oath, receiving affidavit evidence, requiring discovery and production of documents, and inspecting data, books, registers, accounts and other documents.
5. Limits on interference with day-to-day operations
Section 28(8) restricts the Board and its officers from preventing access to premises or taking custody of equipment or other items where doing so may adversely affect a person's day-to-day functioning. The provision therefore places an express operational limitation on the exercise of the Board's inquiry powers.
6. Interim and final orders
During an inquiry, the Board may issue an interim order where necessary, but it must record reasons and first give the concerned person an opportunity of hearing. At the conclusion of the inquiry, it must again provide an opportunity of hearing and record reasons before closing the matter or proceeding under Section 33.
7. False or frivolous complaints
Under Section 28(12), the Board may, at any stage after receiving a complaint, issue a warning or impose costs if it forms the opinion that the complaint is false or frivolous. This power is directed at misuse of the complaint process and is distinct from the Board's inquiry into a substantive breach of the Act.
Digital Personal Data Protection Rules, 2025 and Section 28
The 2025 Rules are now an important part of the procedural framework. In particular, Rule 19 addresses the functioning of the Board as a digital office. The Rules also contain provisions concerning Board meetings and authentication of orders, and the notified framework provides for time-bound conduct of inquiries. Readers applying Section 28 should therefore consult both the Act and the Rules in their current form.
Key legal points
- The Board is intended to operate independently and, as far as practicable, digitally.
- An inquiry is not automatic; the Board first determines whether sufficient grounds exist.
- Closure for insufficient grounds requires written reasons.
- Every inquiry must follow natural justice, and material procedural actions must be reasoned.
- The Board has specified civil-court-type powers for evidence, attendance and document inspection.
- Interim orders and final action require an opportunity of hearing.
- The Board may seek assistance from police officers and Central or State Government officers.
- False or frivolous complaints may result in a warning or costs.
Related provisions
For a complete understanding of the Board's jurisdiction and remedies, Section 28 should be read with Section 27 - Powers and functions of Board, Section 29 - Appeal to Appellate Tribunal, and Section 30 - Execution of Appellate Tribunal orders as decrees.
Updated: 24 September 2026. This page is a general legal information resource. For an actual proceeding, refer to the official text of the Act, applicable Rules, notifications and orders.