Organisations receiving a DPB show cause notice have a limited window (typically 21–30 days) to respond. The quality of your response — including evidence of remediation, good faith, and prior compliance steps — directly influences the penalty outcome. This pack gives you the complete framework.
When the Data Protection Board comes knocking — be ready. Complete response framework, evidence kit, and penalty mitigation playbook.
Upon receiving a DPB show cause notice, your first 48 hours are critical. The notice will specify the alleged violation, the relevant section of the DPDP Act 2023, and your response deadline. Do not ignore or delay — this playbook walks you through every step.
Step 1 — Internal Triage (Hour 0–24): Assign a single point of contact (legal lead or DPO). Read the notice carefully and identify: (a) the specific provision alleged to be violated, (b) the period covered, (c) the deadline for your response. Preserve all documents, emails, and system logs related to the incident — initiate a litigation hold immediately.
Step 2 — Legal Counsel Briefing (Hour 24–48): Brief your DPDP-aware legal counsel. Provide them with: the notice itself, your privacy policy (current version), your data inventory / ROPA, any existing consent records, your breach notification log (if applicable), and all prior correspondence with the DPB or relevant regulator.
Step 3 — Response Framework: Your written response must address: (a) a factual rebuttal or acknowledgement of the incident, (b) your version of events with a detailed timeline, (c) remediation steps already taken, (d) proposed future remediation with deadlines, (e) any mitigating factors (see Section 3). A well-structured response can significantly reduce the quantum of penalty.
Evidence preservation is the foundation of your defense. Once a notice is received, no document, email, or system log related to the alleged incident may be deleted, modified, or overwritten. Violation of this principle can be treated as obstruction and dramatically worsens your position.
Mandatory Evidence to Preserve: Consent records (timestamps, IPs, versions), privacy policy version history, data inventory and processing records, breach detection logs and notification records, training records for relevant staff, vendor contracts and Data Processing Agreements, board/management communications about the incident, and all prior regulatory correspondence.
Digital Forensics Note: For data breach cases, preserve server logs, SIEM alerts, access logs, and any forensic analysis reports in read-only format. Chain of custody documentation should be initiated if the matter is likely to proceed to a hearing.
Create an Evidence Bundle — a single organised folder (digital or physical) containing numbered, indexed copies of every document. This bundle is what your legal counsel will work from and what you may be required to produce at the DPB hearing.
A show cause notice from the Data Protection Board is not the end of the matter — it is the beginning of a process in which your response quality is everything. Organisations that respond promptly, with well-organised evidence and a credible remediation plan, consistently achieve better outcomes than those that respond minimally or defensively.
The DPDP Act 2023 gives the DPB discretion in setting penalty amounts. Schedule penalties are maxima — not automatic. Factors like the nature of the violation, the number of affected data principals, the degree of negligence, and the remediation steps taken all influence the final penalty. A professional, evidence-based response activates every available mitigation factor.
DPDP Act penalties range from ₹50 crore (for failures to implement reasonable security safeguards in data breaches) up to ₹250 crore for violations by Significant Data Fiduciaries. These are statutory maxima — the DPB may impose lower amounts based on mitigating factors.
Voluntary disclosure, prompt remediation, cooperation with the DPB investigation, and evidence of prior compliance investment are among the most powerful mitigation factors. This pack gives you the framework to document and present all of them effectively.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
