India DPDPA: Article 27 – Powers and functions of Board
27. Powers and functions of Board
(1) The Board shall exercise and perform the following powers and functions, namely:—
(a) on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;
(b) on a complaint made by a Data Principal in respect of a personal data breach or a breach in observance by a Data Fiduciary of its obligations in relation to her personal data or the exercise of her rights under the provisions of this Act, or on a reference made to it by the Central Government or a State Government, or in compliance of the directions of any court, to inquire into such breach and impose penalty as provided in this Act;
(c) on a complaint made by a Data Principal in respect of a breach in observance by a Consent Manager of its obligations in relation to her personal data, to inquire into such breach and impose penalty as provided in this Act;
(d) on receipt of an intimation of breach of any condition of registration of a Consent Manager, to inquire into such breach and impose penalty as provided in this Act; and
(e) on a reference made by the Central Government in respect of the breach in observance of the provisions of sub-section (2) of section 36 (?) (ed: Should be 37)by an intermediary, to inquire into such breach and impose penalty as provided in this Act.
(2) The Board may, for the effective discharge of its functions under the provisions of this Act, after giving the person concerned an opportunity of being heard and after recording reasons in writing, issue such directions as it may consider necessary to such person, who shall be bound to comply with the same.
(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw or cancel such direction and, while doing so, impose such conditions as it may deem fit, subject to which the modification, suspension, withdrawal or cancellation shall have effect.
What Article 27 Means for Your Business
Article 27 is one of the most operationally significant provisions of the DPDPA for compliance teams. It defines the full range of the Data Protection Board’s enforcement powers, from directing urgent remedial action following a breach to conducting inquiries and imposing penalties of up to ₹250 crore.
- The Board can act on its own initiative following a breach notification, it does not need to wait for a complaint from a Data Principal to open an inquiry.
- In urgent situations, the Board can direct immediate remedial or mitigation measures, your incident response plan must include a Board notification and response track alongside technical containment steps.
- The Board can summon persons, require documents, and conduct hearings, non-cooperation with a Board inquiry is itself a breach that can attract additional penalties.
- Penalties can reach ₹250 crore for the most serious breaches, assess the potential financial exposure for your organisation across each obligation under the Act.
- The Board also has the power to refer matters to alternate dispute resolution, understand when this pathway may be available and advantageous in any dispute.