Chapter VI · Powers, Functions and Procedure
Section 28: Procedure to be Followed by Board
Section 28 is the Board's due-process rulebook: a digital-by-design inquiry that starts with a sufficient-grounds test, runs on civil-court evidence powers under natural justice, and ends in either closure or a Section 33 penalty.
- Chapter
- Chapter VI · Powers, Functions and Procedure
- Status
- Enacted · phased commencement
- Full compliance
- 13 May 2027
- Applies to
- Board · Data Fiduciaries
- Official citation
- DPDP Act, 2023, s.28
- Reading time
- 7 min
- Updated
- August 2026
At a glance
Section 28 sets the procedure the Data Protection Board follows once a matter reaches it under Section 27. The Board functions as an independent, digital-by-design office [28(1)] and acts on the Section 27(1) triggers [28(2)]. It first decides whether there are sufficient grounds to inquire [28(3)]; if not, it closes the case with reasons recorded [28(4)]. If it proceeds, it inquires into the person's affairs [28(5)] following natural justice and recording reasons [28(6)], with civil-court powers under the Code of Civil Procedure 1908 to summon and examine on oath, take affidavit evidence, require discovery and production, and inspect records [28(7)]. It may not block premises access or seize equipment in a way that harms day-to-day functioning [28(8)], and it may requisition police or government assistance [28(9)]. It can issue interim orders after a hearing [28(10)], and on completion either close the proceedings or proceed to a penalty under Section 33 [28(11)]. A false or frivolous complaint can draw a warning or costs on the complainant [28(12)]. Section 28 takes effect on 13 May 2027.
Key takeaways
- Section 28 is the Board's due-process rulebook: how an inquiry runs once a matter arrives under Section 27.
- It is digital by design [28(1)]: complaints, allocation, hearings and decisions are meant to run as an online office.
- Nothing is automatic: the Board must first find sufficient grounds to inquire [28(3)], and can close a case with reasons if not [28(4)].
- In an inquiry the Board has civil-court powers [28(7)]: summon and examine on oath, take affidavit evidence, require discovery and production, and inspect records.
- 28(8) is a real limit: the Board cannot block your premises or seize equipment in a way that harms day-to-day functioning, though it can still inspect and demand documents.
- On completion the Board closes the case or proceeds to a penalty under Section 33 [28(11)]; a false or frivolous complaint can draw a warning or costs [28(12)].
Who should read this
Read this if you might face a Board inquiry: it maps the process end to end, what the Board can and cannot do to your premises and systems, and where your right to be heard sits.
In plain language
Section 28 is the how to Section 27's why. Once a matter reaches the Board, this section governs the inquiry, and it does not turn every complaint into a penalty.
The Board first asks whether there are sufficient grounds. If not, it can close the case, recording reasons. If it proceeds, it can summon people, take evidence on oath, require documents and inspect records, but it must follow natural justice, hear you before any interim order or adverse outcome, and record its reasons.
There is a deliberate operational guardrail: the Board cannot block access to your premises or seize equipment where that would disrupt your day-to-day functioning. It ends by either closing the matter or moving to a penalty decision under Section 33.
The text of the law
Section 28: Procedure to be Followed by Board
28(1) The Board functions as an independent body and, as far as practicable, as a digital office, with the receipt of complaints and the allocation, hearing and pronouncement of decisions being digital by design, adopting the prescribed techno-legal measures.
28(2) On an intimation, complaint, reference or court direction under Section 27(1), the Board may take action under the Act and the Rules.
28(3)-(4) The Board determines whether there are sufficient grounds to inquire; if it finds insufficient grounds, it may close the proceedings for reasons recorded in writing.
28(5)-(6) If there are sufficient grounds, it may, for recorded reasons, inquire into any person's affairs to check compliance, following the principles of natural justice and recording reasons for its actions.
28(7) For its functions the Board has the powers of a civil court under the Code of Civil Procedure 1908 to: (a) summon and enforce attendance and examine a person on oath; (b) receive affidavit evidence and require discovery and production of documents; (c) inspect data, books, documents, registers, books of account or other documents; and (d) any other prescribed matters.
28(8) The Board or its officers shall not prevent access to any premises or take custody of equipment or any item where doing so may adversely affect a person's day-to-day functioning.
28(9) The Board may requisition the assistance of any police officer or Central or State Government officer, who must comply.
28(10) During the inquiry, the Board may issue interim orders for recorded reasons, after giving the person an opportunity of being heard.
28(11) On completion, after a hearing, the Board may, for recorded reasons, either close the proceedings or proceed under Section 33.
28(12) At any stage after a complaint, if the Board considers it false or frivolous, it may issue a warning or impose costs on the complainant.
Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.
What this means for you
- Build a Board Inquiry Response Playbook now: named owners across legal, privacy, security, records and communications, so a summons or notice routes instantly and staff do not give inconsistent answers.
- Keep an evidence pack under legal hold: logs, tickets, consent and notice records, data map, processor contracts and instructions, rights-request records, retention decisions, breach chronology and remediation evidence.
- Know your 28(8) protection and its limit: the Board cannot seize production equipment or block premises in a way that halts operations, but you cannot refuse lawful inspection, document production or a summons.
- Treat an interim order and any 27(2) direction as binding: build a fast executive process to assess and comply while preserving your Section 29 appeal rights.
- Consider a voluntary undertaking under Section 32 where remediation is the right path, but do not assume offering one prevents an inquiry or penalty. Not sure you could withstand a Board inquiry? Take the readiness assessment or find a specialist.
Frequently asked questions
Does a Board inquiry mean we will be penalised?
Can the Board summon our CEO, DPO or cloud provider?
Can the Board seize our servers or shut our office?
How long can an inquiry take?
Can we settle through remediation instead of a penalty?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.