What should a company do when the Data Protection Board opens an investigation? When the Data Protection Board (DPB) opens an inquiry or issues a show-cause notice, the company should immediately preserve all relevant evidence, freeze any deletion or auto-purge routines touching the data in question, assemble a response team spanning legal, IT, DPO and leadership, and prepare a factual written response within the notice deadline. Rushed, defensive or incomplete responses are the single biggest driver of higher penalties. This playbook gives you the first-72-hours checklist, evidence preservation protocol, response drafting structure, hearing preparation guide, and an escalation matrix mapping who acts at each stage of a DPB inquiry.
A structured response plan for an active Data Protection Board inquiry or show-cause notice — first 72 hours, evidence preservation, hearing prep and voluntary-undertaking strategy.
Hour 0–4: Notify the founder/CEO, the designated Grievance Officer or DPO, and external counsel the moment any communication is received from the Data Protection Board — even an informal information request. Do not respond, acknowledge, or send any document to the DPB before counsel has reviewed the notice and the underlying allegation. Log the exact date and time the notice was received; the response deadline runs from this date, not from when leadership becomes aware of it.
Hour 4–24: Issue an internal litigation hold: instruct IT, HR and all business units named or implicated in the notice to stop any routine deletion, auto-purge or log-rotation process that could destroy relevant records. Identify every system, vendor and individual that may hold evidence relevant to the allegation. Do not make any public statement, social media post or client communication about the inquiry without counsel sign-off.
Preserve, in original and unaltered form: consent logs and consent-capture screenshots for the relevant period; the privacy notice version live at the time of the alleged incident; breach detection and internal escalation logs if the inquiry concerns a breach; access logs showing who touched the data in question; all vendor/DPA agreements covering the data at issue; and any internal emails, tickets or Slack threads discussing the underlying issue before the DPB notice arrived. Export logs to a separate, access-controlled evidence folder — do not rely on live production systems where retention policies may auto-delete records.
Assign one person (typically the DPO or Grievance Officer) as the single custodian of the evidence file, with a dated index of everything collected. This custodian becomes the primary point of contact for counsel when drafting the response and is often the person who represents the company at any hearing, so choose someone with both technical and process knowledge, not only a legal signatory.
Allegation areas selected for your playbook:
Under the DPDP Act 2023, the Data Protection Board can act on a complaint from a Data Principal, a referral from another government body, media or public reporting of a suspected breach, or on its own initiative (suo motu) where it has reason to believe a Data Fiduciary has failed to meet its obligations. Once enforcement begins around May 2027, the DPB is expected to function as a digital-first, largely paperless body — notices, responses and hearings conducted primarily online — which means response timelines can move faster than companies are used to under other Indian regulators.
The single most common mistake companies make is treating an initial information request as informal and low-stakes. Every communication from the DPB should be treated as the start of a formal record, reviewed by counsel before any reply, with a documented internal response process from day one. How a company behaves in the first week of an inquiry materially affects the outcome, because the DPB explicitly considers good faith, cooperation and prior compliance effort when determining penalties.
Penalties under the DPDP Act scale by the nature of the failure — up to Rs 250 crore for inadequate security safeguards, up to Rs 200 crore for failure to notify a breach or for violations involving children's data, and up to Rs 50 crore for other obligations such as data principal rights handling. These are ceilings, not fixed amounts: the DPB determines the actual penalty considering the nature, gravity and duration of the breach, the type of data affected, whether the fiduciary gained any benefit, and the mitigation steps taken. A well-documented, prompt, and cooperative response — including a credible remediation plan or a Section 32 voluntary undertaking — is the primary lever a company has to influence that final number.
This is why response quality matters as much as the underlying facts. Companies that can show they preserved evidence properly, engaged counsel immediately, cooperated fully, and had a functioning compliance programme before the inquiry began are in a fundamentally stronger position than companies scrambling to construct a defence after the fact. With enforcement approaching in May 2027, every company handling personal data at scale should have this playbook ready before it is needed — Niti Bharat's fixed-price DPDP compliance engagements (Rs 75,000–Rs 3.2 lakh) build the underlying documentation and governance record that makes any future DPB response defensible.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
