Section 28 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The first six sub-sections of section 28 set the frame for every Board proceeding. The Board works as an independent body and, as far as practicable, as a digital office. It first decides whether there are sufficient grounds to proceed, records reasons for closing or continuing, and conducts any inquiry on the principles of natural justice. Sub-sections (7) to (12) are in the next article. For help in a Board matter, see our legal dispute resolution service.
The Board "shall function as an independent body" and, as far as practicable, as a digital office, with receipt of complaints and the allocation, hearing and pronouncement of decisions digital by design (28(1)). On an intimation, complaint, reference or direction under section 27(1), it takes action under the Act and the Rules (28(2)). It first determines whether there are sufficient grounds (28(3)). If not, it may close the proceedings for reasons recorded in writing (28(4)). If yes, it may inquire into the affairs of any person, again for reasons recorded in writing (28(5)), following natural justice and recording reasons for its actions (28(6)).
The sub-sections at a glance
| Sub-section | What it provides |
|---|---|
| 28(1) | Independent body; digital office as far as practicable; digital by design; techno-legal measures as prescribed |
| 28(2) | On an intimation, complaint, reference or direction under section 27(1), the Board acts under the Act and the Rules |
| 28(3) | Board determines whether there are sufficient grounds to proceed with an inquiry |
| 28(4) | If insufficient, Board may close the proceedings, for reasons recorded in writing |
| 28(5) | If sufficient, Board may inquire, for reasons recorded in writing, into the affairs of any person to ascertain whether she is complying or has complied with the Act |
| 28(6) | Inquiry follows the principles of natural justice; reasons recorded for its actions |
28(1): independent and digital by design
The Board "shall function as an independent body and shall, as far as practicable, function as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions in respect of the same being digital by design, and adopt such techno-legal measures as may be prescribed."
What follows for a party:
- Expect digital filing and hearings. The text covers receipt, allocation, hearing and pronouncement. "As far as practicable" leaves room for exceptions; the Act does not say when.
- Techno-legal measures are for the Rules (section 40(2)(v)). The DPDP Rules, 2025 (notified November 2025) are the place to look; this article states no detail from them.
- Independence is stated as a function of the Board. For how its Members are appointed and removed, see sections 19 to 21.
28(2): the gateway
The Board acts when it receives "an intimation or complaint or reference or directions as referred to in sub-section (1) of section 27". Those are the five inputs: a breach intimation, a Data Principal's complaint, a Consent Manager complaint or registration-breach intimation, a Government reference and a court's directions, plus the intermediary reference. See section 27. Action is "in accordance with the provisions of this Act and the rules made thereunder".
28(3) and (4): the threshold test
28(3) "The Board shall determine whether there are sufficient grounds to proceed with an inquiry." This is a screening step. The Act does not define "sufficient grounds" or set a time for the decision.
28(4) If the Board finds insufficient grounds, "it may, for reasons to be recorded in writing, close the proceedings."
Two practical points.
- Write the complaint to pass the screen. A Data Principal's complaint should identify the fiduciary, the act or omission, the personal data involved and the grievance route already tried (section 13(3) requires exhaustion of that route first).
- Closure is not a finding of compliance. Closure under 28(4) rests on insufficient grounds. The Act does not say whether a closed complaint can be revived by fresh material; a fiduciary should not treat closure as a clearance.
28(5): the inquiry
Where grounds are sufficient, the Board "may, for reasons to be recorded in writing, inquire into the affairs of any person for ascertaining whether such person is complying with or has complied with the provisions of this Act."
Three observations.
- "Any person". The inquiry is not limited to the person named in the complaint. It can reach a Data Processor, a Consent Manager or an intermediary as the facts require.
- Past and present compliance. "Is complying with or has complied" covers ongoing and historic conduct.
- "May". Even with sufficient grounds the Board has a discretion, although it must record reasons for proceeding.
28(6): natural justice and reasons
"The Board shall conduct such inquiry following the principles of natural justice and shall record reasons for its actions during the course of such inquiry."
Natural justice usually means notice of the case, a fair opportunity to respond and an unbiased decision-maker. The Act does not list the steps. Sub-sections (10) and (11) separately require an opportunity of being heard before interim orders and before closing or proceeding to penalty. The requirement to record reasons applies to actions "during the course of" the inquiry, so each significant step should have a reasoned record. Such a record is also what an Appellate Tribunal will examine in an appeal under section 29.
Steps a fiduciary should take
- Keep an incident and grievance log that can be produced digitally.
- Nominate a response owner for Board communications, since the process is digital by design.
- Answer at the screening stage. The sufficient-grounds test is the cheapest place to show the complaint lacks substance, if it does.
- Preserve documents. The Board's power to call for evidence and inspect records is in 28(7). See the next article.
- Do not wait for the penalty stage to raise mitigation. Section 33(2)(e) looks at action taken to mitigate and its timeliness.
Example
A user complains to the Board that a company ignored her correction request. The Board looks first at whether there are sufficient grounds: has she used the company's grievance route, is there an act or omission, does the Act's duty apply? If not, the Board may close the complaint and record why. If so, it may inquire into the company's affairs, record reasons and follow natural justice.
What these sub-sections do not say
- No time limit for completing an inquiry.
- No definition of "sufficient grounds" or "natural justice" steps.
- No rule on whether complainant and fiduciary are heard together.
- No mention of legal representation before the Board.
Need help in a Board proceeding?
The early stages set the tone for everything that follows. Our legal dispute resolution team can help you prepare a response to a complaint, organise your records for a digital hearing and plan for each stage of the inquiry.
Key takeaways
- The Board functions as an independent, digital-by-design office as far as practicable.
- It first decides whether there are sufficient grounds; closure needs written reasons.
- An inquiry can reach the affairs of any person and is conducted under natural justice.
- Reasons are recorded for actions in the inquiry.
- Techno-legal measures and further matters are left to the Rules.
Read next
- Section 28 (7)-(12): civil court powers, interim orders and frivolous complaints
- Section 27 of the DPDP Act, 2023: powers and functions of the Board
- Section 13 of the DPDP Act, 2023: right of grievance redressal
- Section 33 of the DPDP Act, 2023: monetary penalty and factors
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.