A DPB show cause notice must be responded to within the deadline specified in the notice (typically 21–30 days). Your response quality — evidence of remediation, good faith, and prior compliance steps — directly determines the penalty outcome. Do not respond without a structured framework.
Received a DPB show cause notice? This kit gives you the complete response framework — evidence, templates, timelines, and hearing prep.
The DPB show cause response process has three phases: (1) Triage and stabilisation — understand exactly what is alleged and stop any ongoing violation immediately. (2) Evidence assembly — gather everything that supports your position and documents remediation. (3) Response drafting — structured, evidence-backed written response addressing each allegation specifically.
Phase 1 — Triage (Hours 0–48): Read the notice carefully. Identify: the specific DPDP Act section alleged to be violated, the period covered, the data subjects affected (if stated), and the response deadline. Issue an internal litigation hold — no documents, emails, or system logs related to the incident may be modified or deleted. Assign a single point of contact for all DPB communications.
Phase 2 — Evidence Assembly (Days 3–10): Systematically gather all evidence relevant to the alleged violation. Organise into an Evidence Bundle: numbered, indexed, and in chronological order. Your legal counsel will work from this bundle and it may need to be submitted to the DPB.
Phase 3 — Response Drafting (Days 10–18): The written response should follow this structure: (a) Brief factual background of the organisation and the incident context. (b) Response to each allegation in the notice, with specific evidence citations. (c) Timeline of remediation actions already taken. (d) Proposed future remediation with committed deadlines. (e) Mitigating factors — good faith, prior compliance investment, cooperation.
This 35-item evidence checklist covers every document category the DPB is likely to examine. Check off each item and note where the document is located — build your Evidence Bundle in a secure, numbered folder system.
Consent and Notice Evidence: (1) Current privacy policy with effective date (2) Privacy policy version at time of alleged violation (3) Consent records for affected data subjects — timestamps, IPs, consent text version (4) Consent notice displayed to users at point of data collection (5) Any consent withdrawal records (6) Cookie consent logs if applicable.
Security and Process Evidence: (7) Security policy documents (8) Breach detection and response logs (9) SIEM / security monitoring records for the relevant period (10) Access control logs for systems containing affected data (11) Vendor contracts and DPAs for all third-party processors handling affected data (12) Staff training records — who was trained, when, on what.
Governance Evidence: (13) Board or management communications about data protection (14) Prior compliance investment evidence — assessments commissioned, tools implemented (15) Grievance officer appointment and contact publication (16) Data inventory / ROPA excerpts for the affected data category (17) Prior regulatory correspondence. Evidence of proactive compliance investment — even if the violation still occurred — is among the most powerful mitigation factors.
A show cause notice from the Data Protection Board of India is a formal allegation that your organisation has violated the DPDP Act 2023. It is not a penalty in itself — it is an opportunity to be heard before any penalty is imposed. The quality of your response to this notice is the single most important factor in the penalty outcome.
Organisations that respond promptly, with well-organised evidence, a credible remediation plan, and a professional written submission consistently achieve better outcomes. Organisations that respond minimally, miss the deadline, or appear defensive without evidence typically face the higher end of the penalty range.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
