A complaint to the Data Protection Board of India can be filed by a Data Principal (individual), a data fiduciary, or referred by the government. The Board reviews the complaint and decides whether to open an inquiry. If it proceeds, a show cause notice is issued to the data fiduciary, who submits a written response and may get a hearing. The Board then either imposes a monetary penalty or accepts a voluntary undertaking under Section 32, closing or barring further proceedings on that matter.
From the moment a complaint is filed to the moment a determination is made — here is exactly how the DPB complaint process works under the DPDP Act 2023.
Under the DPDP Act 2023, a complaint can originate from a Data Principal whose personal data rights have allegedly been violated, from another data fiduciary in a dispute over processing obligations, or through a reference from the Central Government. The Board can also examine matters on its own initiative in certain circumstances. This is a broader base of potential complainants than many Indian companies assume — it is not limited to individual customers filing directly.
Because the Board is designed to operate as a digital office, the filing and review process is expected to be largely online, which lowers the practical barrier for a Data Principal to raise a complaint compared to traditional consumer forums or courts.
Section 32 of the DPDP Act allows a data fiduciary to offer a voluntary undertaking — for example, committing to specific corrective actions and a timeline — which the Board can accept in lieu of, or to close, proceedings. Whether the Board accepts an undertaking typically depends on the severity of the alleged violation, whether it is a first instance, and how proactively and credibly the fiduciary has already begun remediation before or during the inquiry.
This is exactly where preparation before a complaint is filed pays off. A company with a documented DPDP Readiness Assessment, evidence of good-faith remediation and a functioning Grievance Officer process is in a materially stronger position to negotiate a favourable outcome than one starting from zero. Niti Bharat's fixed-price DPDP compliance services (₹75K–₹3.2L) are built to create exactly this kind of defensible position ahead of the May 2027 enforcement date.
A ready-to-use response template, evidence checklist, and internal escalation workflow for handling a Data Principal complaint before — or after — it reaches the DPB.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
