DPDP enforcement deadline: May 2027Rules notified Nov 2025Penalty exposure up to ₹250 Cr

Quick Answer

How do you respond to a Data Protection Board (DPB) complaint in India? Under DPDP Act 2023 and Rules 2025, a Data Fiduciary must acknowledge a DPB complaint within 48 hours and submit a formal written response to the Adjudicating Officer within 30 days. The response must address the specific complaint, state the company's legal position, list corrective actions taken, and provide a compliance commitment. Failure to respond can result in an ex-parte order and penalties of up to ₹250 crore.

DPB Complaint Response Template: Draft Your Data Protection Board Reply in Minutes

Generate a legally-structured response to a Data Protection Board complaint under the DPDP Act 2023 — free, instant, and ready to customise.

Free Tool DPDP Act 2023 / Rules 2025
1
Complaint Details
2
Your Response
3
Copy & Send
How this tool works: Fill in your complaint details below, click "Generate Response", and get a draft formal letter to submit to the Adjudicating Officer of the Data Protection Board of India. The template follows the required structure under DPDP Act 2023 and anticipated Rules 2025 format.
Step 1: Enter Complaint Details
All fields are processed locally in your browser — nothing is sent to our servers at this stage.
Step 2: Your Draft Response
Review and customise the template below before submission. Legal review is recommended before sending to the Board.
Important: This is a draft template for guidance only. Review it with your legal counsel before submitting to the Data Protection Board of India. NitiBharat does not provide legal advice.
Copied!

Need professional support drafting and filing this response? Our DPDP compliance specialists help companies navigate DPB proceedings.

Talk to a DPDP Expert →

What Is a Data Protection Board (DPB) Complaint?

Under the Digital Personal Data Protection Act 2023 (DPDP Act), a Data Principal (an individual whose personal data is being processed) has the right to file a complaint with the Data Protection Board of India if they believe a Data Fiduciary (a company or organisation) has violated their data rights.

Common grounds for DPB complaints include:

The Board is empowered to investigate complaints, adjudicate disputes, and impose substantial financial penalties on non-compliant organisations.

DPB Complaint Response Timelines Under DPDP Rules 2025

Adhering to timelines is non-negotiable. Missing a response window can result in an ex-parte order against your company.

Action Timeline Notes
Acknowledge receipt of DPB notice 48 hours Written acknowledgment to the Adjudicating Officer
Submit formal written response 30 days From date of receipt of the Board's notice; extensions may be granted on application
Appear before Adjudicating Officer (if hearing scheduled) As notified May be in-person or video conference; representation by legal counsel permitted
Comply with Board's order As specified in order Typically 30–90 days; non-compliance triggers additional penalties

Frequently Asked Questions

What is the timeline to respond to a Data Protection Board complaint under DPDP Act 2023? +
Under the Digital Personal Data Protection Act 2023 and DPDP Rules 2025, a Data Fiduciary must acknowledge receipt of a DPB complaint within 48 hours. The full written response addressing the complaint must be submitted to the Adjudicating Officer within 30 days of receipt of the notice, unless the Board grants an extension. Early acknowledgment demonstrates good faith and is viewed positively by the Adjudicating Officer.
What happens if a company does not respond to a DPB complaint? +
If a Data Fiduciary fails to respond to a Data Protection Board complaint within the prescribed timeline, the Adjudicating Officer may proceed ex-parte — that is, make a decision without the company's input. This significantly increases the risk of an adverse finding. The Board can impose financial penalties of up to ₹250 crore for non-compliance with DPDP Act provisions. Timely, substantive response is therefore critical to protecting your organisation.
What must a formal DPB complaint response include? +
A formal Data Protection Board response should include: (1) acknowledgment of receipt of the Board's notice citing the complaint reference number; (2) a factual summary of the complaint as understood by the organisation; (3) the company's legal position under the DPDP Act and applicable Rules — including any lawful basis for the processing in question; (4) specific corrective actions already taken or planned, with dates and timelines; (5) a formal commitment to ongoing compliance; and (6) contact details of the authorised representative for further correspondence with the Board. Using our free template above ensures all these elements are covered.

Need Expert Help with Your DPB Response?

Our DPDP compliance specialists have drafted responses for companies across IT, HRMS, healthcare, and fintech. We help you respond correctly — the first time.

Book a Free 30-Min Consultation →
Every Sunday

The Sunday DPDP Brief

One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.

No spam. Unsubscribe with one click, anytime.

Related tools & reading
DPDP Act Enforcement Deadline CountdownDPDP Breach Notification Timeline CalculatorDPDP Compliance Checklist 2026DPDP अनुपालन कैलेंडरSee all Reference & Checklists tools →📝 DPDP in House vs Consultant📝 What Is Data Protection Officer DPDP