How do you file a DPDP appeal against a Data Protection Board order? A DPDP appeal against a Data Protection Board (DPB) order is filed before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), and it must be filed within 60 days of receiving the order. The appeal takes the form of a memorandum of appeal setting out the impugned order, a concise statement of facts, the grounds on which the order is challenged (errors of fact, errors of law, procedural unfairness, or disproportionate penalty), the relief sought, and a supporting affidavit with the certified copy of the DPB order annexed. Missing the 60-day window is the single most common way a company loses its right to appeal, so the clock — which runs from the date the order is received, not the date it is reviewed internally — must be diarised the moment an adverse order arrives. This DPDP appeal filing kit gives you the memorandum structure, a grounds-of-appeal template, the stay-of-penalty application, and a filing checklist mapped to the TDSAT process.
Templates and a step-by-step guide for appealing a Data Protection Board order to TDSAT — memorandum of appeal, grounds template, stay application and the 60-day filing checklist.
An appeal against a Data Protection Board order lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), and the DPDP Act sets a 60-day limitation period that runs from the date you receive the order — not from the date leadership reviews it or the date counsel is engaged. Diarise this deadline the moment the order arrives, log the exact date of receipt (retain the covering email, courier proof or portal timestamp as evidence of the receipt date), and work backwards to a filing target that leaves a buffer of at least a week for affidavit swearing, certified-copy attachment and any last-minute corrections.
TDSAT has discretion to condone a limited delay only where sufficient cause is shown, but this is never something to rely on — a condonation application adds cost, uncertainty and a preliminary hurdle before your appeal is even heard on merits. The practical rule is simple: treat the 60 days as a hard stop, front-load the drafting, and file with days to spare. If you receive the order close to the end of the window, engaging appellate counsel and starting the memorandum immediately is the priority action above everything else, because the right to appeal is worth nothing once the window lapses.
A strong appeal does not simply re-argue the facts — it identifies specific, articulable errors in the DPB's order and frames them as grounds. The four workhorse categories are: errors of fact (the order relies on findings not supported by the evidence on record, or ignores evidence the company submitted); errors of law (the DPB misapplied a provision of the DPDP Act, applied the wrong penalty ceiling, or misread the obligation at issue); procedural unfairness (the company was not given a fair opportunity to be heard, was denied documents relied on against it, or the order lacks reasons); and disproportionate penalty (the amount is excessive relative to the nature, gravity and duration of the failure, or the DPB failed to weigh mitigation and remediation the company had already undertaken).
Each ground should be pleaded as a numbered paragraph that states the error, points to the specific part of the order where it appears, and explains why it is wrong — with a cross-reference to the record. Do not pad the memorandum with weak grounds; a focused appeal built on two or three well-evidenced errors reads far better before a tribunal than a scattergun list. Penalty grounds are particularly worth pleading where the DPB imposed an amount approaching the statutory ceilings — up to ₹250 crore for a security-safeguard failure leading to a breach, up to ₹200 crore for breach-notification or children's-data failures, and up to ₹50 crore for other general-obligation failures — because these are ceilings, not fixed amounts, and the appellate forum can review whether the quantum was proportionate.
Grounds selected for your appeal kit:
Under the DPDP Act 2023, a person aggrieved by a decision or order of the Data Protection Board of India may appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), the same tribunal that hears telecom and broadcasting disputes. The appeal must be filed within 60 days of the date the order is received, and the tribunal hears the matter afresh on the grounds raised rather than acting as a mere rubber stamp. Once enforcement begins around May 2027, the DPB is expected to operate as a digital-first body, which means orders may be served and appeals initiated through online channels — making it even more important to log receipt dates precisely and to have an appeal filing kit ready before an adverse order ever lands.
The 60-day limitation period is the hinge on which the entire right to appeal turns. Companies lose appeals not on merits but on the calendar — an order sits in a shared inbox, gets escalated late, and by the time counsel is engaged the window has narrowed to days. The disciplined response is to treat any DPB order as time-critical from the moment of receipt: diarise the 60-day deadline, preserve proof of the receipt date, and begin the memorandum immediately, even while the strategic decision on grounds is still being finalised.
A persuasive appeal is precise, evidenced and proportionate in tone. It identifies specific errors in the DPB's order, cross-references the record, and asks for defined relief — setting aside the order, reducing the penalty, or remitting the matter for fresh consideration. Where a monetary penalty is involved, a well-argued proportionality ground carries real weight, because the DPDP penalties are statutory ceilings (up to ₹250 crore, ₹200 crore and ₹50 crore depending on the nature of the failure) that the DPB must apply proportionately to the facts — and an appellate forum can review whether it did so. Pairing the appeal with a stay application prevents the penalty from being enforced while the challenge is pending.
Getting this right under time pressure is difficult without a template to work from, which is exactly what this kit provides. For companies that would rather not face a DPB order in the first place, the more durable investment is a defensible compliance record built before enforcement arrives — Niti Bharat runs fixed-price DPDP compliance engagements (₹75,000–₹3.2 lakh) that produce the documentation and governance trail which both reduces the odds of an adverse order and strengthens any appeal if one comes.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
