DPDPA Legal

🧑‍💼

Step 1 · Initiation

Data Principal Identifies a Violation

You (the Data Principal) identify a violation of your rights under the DPDPA — such as unauthorised data processing, data breach, denial of access/erasure/correction, misuse of consent, or cross-border transfer without approval.

Identify Violation Gather Evidence Document Timeline

Submit Complaint

🏢

Step 2 · Mandatory First Step

Grievance Officer / Data Protection Officer (DPO)

Your complaint must first be raised with the Data Fiduciary's designated Grievance Officer — or DPO if the organization is a Significant Data Fiduciary. The organization is legally obligated to acknowledge and resolve the grievance within a reasonable timeframe.

Written Complaint Acknowledgement Mandatory

Decision

Resolved by Grievance Officer / DPO?

✅ Yes — Resolved

Complaint settled.
Matter closed. ✓

❌ No — Unresolved

No response / rejected / unsatisfactory → Escalate

Escalate

⭐ Optional ADR — Best Practice

🤝

Step 3 · Optional · Alternative Dispute Resolution

Online Dispute Resolution (ODR) via DPDP Legal

Before escalating to the Board, parties may opt for an Online Dispute Resolution (ODR) process facilitated by DPDP Legal experts. This ADR mechanism — through structured mediation, conciliation, or arbitration — is faster, cost-effective, and builds a documented record that assists the Board if the matter is subsequently escalated.

ODR via DPDP Legal Mediation / Conciliation ADR Best Practice Assists the Board Faster Resolution

Decision

Resolved via ODR / ADR?

✅ Yes — Settled

Settlement recorded.
Matter closed. ✓

❌ No — Unresolved

Proceed to Data Protection Board for formal adjudication

Formal Complaint

⚖️

Step 4 · Formal Adjudication

Data Protection Board of India (DPBI)

You file a formal complaint with the Data Protection Board of India. The Board investigates, issues notices to the Data Fiduciary, conducts digital hearings, and receives submissions from both parties. The Board operates as a fully digital office with powers of investigation and inquiry.

Digital Filing Notice to Data Fiduciary Hearing of Parties Investigation Powers

Board Passes Order

📋

Step 5 · Enforcement

Board Order & Financial Penalty

The Board issues a reasoned, binding order — directing compliance, imposing financial penalties on the Data Fiduciary, or dismissing the complaint. Non-compliance with a Board order is itself an additional punishable offence under the Act.

Binding Order Financial Penalty Compliance Direction Dismissal (if no merit)

⚡ Penalty Scale Under DPDPA 2023

₹250 CroreHighest

Failure to implement security safeguards / data breach

₹200 Crore

Breach of children's data processing obligations

₹150 Crore

Significant Data Fiduciary non-compliance

₹50 Crore

Denial of Data Principal rights & other violations

Decision

Aggrieved by Board's Order?

✅ Accepted

Order accepted.
Compliance enforced. ✓

⚠️ Aggrieved

Appeal to TDSAT within 60 days of Board's order

File Appeal — TDSAT

🏛️

Step 6 · First Appellate Forum

Telecom Disputes Settlement & Appellate Tribunal (TDSAT)

Any party aggrieved by the Data Protection Board's order may prefer an appeal before TDSAT — the designated appellate tribunal under the DPDPA. TDSAT reviews the matter on both facts and law, hears both parties, and may affirm, modify, or set aside the Board's order. TDSAT may also grant a stay of the Board's order pending appeal.

Designated Appellate Tribunal Facts & Law Review Affirm / Modify / Set Aside Stay of Order Available

⏱️

60 Days — from the date of receipt of the Board's order, to file appeal before TDSAT.

Condonation of delay is possible on demonstrating sufficient cause. Principles of the Limitation Act, 1963 apply. No fixed outer ceiling for condoned delays.

Decision

TDSAT Order — Outcome?

✅ SETTLED

Matter Closed
TDSAT order accepted.
Compliance enforced. ✓

⚠️ AGGRIEVED

→ Supreme Court
File SLP within
90 days of TDSAT order

SLP / Final Appeal

🔴 Final & Binding

🏛️

Step 7 · Final Appellate Forum

Supreme Court of India

A party aggrieved by TDSAT's order may approach the Supreme Court of India by filing a Special Leave Petition (SLP) under Article 136 of the Constitution, or a Writ Petition under Article 32. The Court entertains matters involving substantial questions of law of general public importance. Its decision is final and conclusively binding on all parties — no further appeal lies.

Special Leave Petition (Art. 136) Writ Petition (Art. 32) Questions of Law Final & Binding No Further Appeal

⏱️

90 Days — from the date of TDSAT's order, to file a Special Leave Petition before the Supreme Court.

Under Article 136 read with the Limitation Act, 1963. The Court may condone delay in exceptional circumstances on sufficient cause shown.

🏁 Final Determination
The Supreme Court's order is conclusive and binding on all parties.
No further domestic appeal is available. The dispute is definitively resolved.

DPDPA Dispute Resolution Pathway