Privacy guide

What is the Data Protection Board of India?

The Data Protection Board explained simply: what this DPDP body is meant to do, how it fits user complaints, and what it could mean for your rights.

The simple answer

The Data Protection Board of India is the body envisioned under the DPDP Act to handle certain data-protection matters, including complaints and enforcement when companies fall short.

For users, the idea is a formal place to escalate after the company route fails. How it operates in practice depends on the rules and procedures as they are notified.

What to check

1
Start with the company grievance route first.

If this is unclear, treat it as a signal to ask the company for a plain-English explanation.

2
Keep evidence for any escalation.

If this is unclear, treat it as a signal to ask the company for a plain-English explanation.

3
Watch for official procedures as they are notified.

If this is unclear, treat it as a signal to ask the company for a plain-English explanation.

4
Use formal routes when they are available and appropriate.

If this is unclear, treat it as a signal to ask the company for a plain-English explanation.

From our investigation

There is meant to be an escalation path.

State of Privacy emphasises evidence because formal routes work best when you arrive with dates, screenshots and a clear record of the company response.

What to do next

1
Exhaust the company grievance route first.

Keep it practical: take one action, save proof, and avoid giving more data than the task needs.

2
Document everything before escalating.

Keep it practical: take one action, save proof, and avoid giving more data than the task needs.

3
Follow official guidance as procedures are notified.

Keep it practical: take one action, save proof, and avoid giving more data than the task needs.

People also ask

What does the Data Protection Board do?

It is meant to handle data-protection matters under DPDP, including complaints and enforcement, as procedures are notified.

Can I complain to it directly?

Generally you start with the company grievance route, then escalate through official procedures as they become available.

Why keep evidence?

Because escalation is stronger with dates, screenshots and a clear record of what you asked and what happened.

If you are a company
Check your own website.

How many trackers run on your pages? Does your privacy policy name them? Can you answer a data-rights email? If you don't know, we can help you find out.

Talk to Meridian Bridge Strategy →
Your right under Indian law
Mera data mera hai.

Your personal data belongs to you. Under DPDP, every company must tell you what they have and delete it if you ask. One email is all it takes.

Get the template email →
Read the full investigation.

We investigated 107 Indian company websites. The public report shows what we found.

Read the reportTry the experience