Consumer and Cyber Laws CBMBL6T05

Syllabus topics (RTMNU)

• Consumer Protection Act, 2019: objectives, scope, and main provisions of the Act
• Definition of terms under the Act - Consumer, Person, Complainant, Goods, Service, Unfair Trade Practices and Misleading Advertisement
• Rights of Consumer
• Consumer Dispute Redressal Commission: Procedures to be followed
• District Commission, State Commission, and National Commissions – Constitution, Powers and functions of commission
• Fines and Penalties under the Act

Consumer Protection Act, 2019: Objectives, Scope and Main Provisions

The Consumer Protection Act, 2019 (CPA 2019) is the law that protects buyers of goods and users of services in India. It replaced the old Consumer Protection Act, 1986. It received the President's assent on 9 August 2019 and most of its provisions came into force on 20 July 2020.

Why a new Act? The 1986 Act was made before e-commerce, online advertising, celebrity endorsements and direct selling. The 2019 Act covers these new markets.

Objectives:

1. Protect consumer rights – to promote and protect the six rights of consumers.
2. Quick and cheap justice – simple, low-cost redressal through Consumer Commissions.
3. Stop unfair trade practices – check false claims, misleading advertisements and unfair contracts.
4. Product liability – make manufacturers, sellers and service providers responsible for harm caused by defective products.
5. Regulate new markets – cover e-commerce, teleshopping, direct selling and multi-level marketing.
6. Consumer awareness – through Consumer Protection Councils at district, state and national level.

Scope: The Act extends to the whole of India. It applies to all goods and services (unless exempted by the Central Government), to all sellers – public, private or co-operative – and to all modes of transaction: offline, online, teleshopping, direct selling and multi-level marketing.

Main provisions (new features):

1. Central Consumer Protection Authority (CCPA) – a regulator set up under the Act to protect consumer rights as a class; it can order recall of unsafe goods, stop unfair trade practices and penalise misleading advertisements.
2. Product liability – a consumer can claim compensation for harm from a defective product or deficient service.
3. E-filing – complaints can be filed online (the e-Daakhil portal) and hearings may be held by video conferencing.
4. Complaint from where the consumer lives or works – not only where the seller is located.
5. Mediation – disputes can be referred to mediation cells attached to the Commissions.
6. Unfair contracts – State and National Commissions can declare one-sided contract terms void.
7. Penalty on endorsers – celebrities endorsing misleading ads can be fined and banned from endorsing.
8. Renamed bodies – "Forums" became "Commissions" with higher money limits.

Definitions: Consumer and Person

Consumer [Section 2(7)]: A consumer is any person who buys goods or hires/avails services for a consideration (price) which is paid, promised, partly paid or under a deferred payment system. It includes any other user of the goods or beneficiary of the service when used with the approval of the buyer. The buying may be offline or online.

Not a consumer: a person who buys goods for resale or for a commercial purpose. However, goods bought and used only for earning a livelihood by self-employment are not "commercial purpose". Example: a tailor who buys one sewing machine to earn his living is a consumer; a garment factory buying 100 machines is not.

Person [Section 2(31)]: includes an individual, a firm (registered or not), a Hindu Undivided Family, a co-operative society, any other association of persons (registered or not) and every other artificial juridical person.

Complainant, Goods and Service

Complainant [Section 2(5)]: the person who files a complaint. It includes: (i) a consumer; (ii) a registered voluntary consumer association; (iii) the Central or State Government; (iv) the CCPA; (v) one or more consumers with the same interest; (vi) the legal heir or representative of a dead consumer; (vii) the parent or guardian of a minor consumer.

Goods [Section 2(21)]: every kind of movable property, and includes "food" as defined in the Food Safety and Standards Act, 2006.

Service [Section 2(42)]: service of any description made available to potential users, such as banking, finance, insurance, transport, processing, supply of electricity or energy, telecom, boarding or lodging, housing construction, entertainment, amusement or news. It excludes free-of-charge service and service under a contract of personal service (e.g. a servant's employment).

Unfair Trade Practices and Misleading Advertisement

Unfair trade practice [Section 2(47)]: a trade practice that uses an unfair method or a deceptive practice to promote the sale, use or supply of goods or services. Examples:

• Falsely claiming goods are of a certain standard, quality or grade.
• Offering "free gifts" or prizes when the cost is already hidden in the price.
• Selling goods that do not meet safety standards set by law.
• Hoarding or destroying goods to raise prices.
• Making fake or spurious goods.
• Not issuing a cash memo or bill.
• Refusing to take back defective goods or refund within the stated period (or 30 days if no period is stated).
• Disclosing a consumer's personal information given in confidence, unless required by law.

Misleading advertisement [Section 2(28)]: an advertisement that falsely describes a product or service, gives a false guarantee, conveys an express or implied representation that would be an unfair trade practice, or deliberately hides important information. Example: a fairness cream claiming "fair skin in 7 days" without proof.

Rights of Consumer

Section 2(9) lists six consumer rights:

1. Right to safety – protection against goods and services hazardous to life and property (e.g. ISI-marked electrical goods).
2. Right to be informed – about quality, quantity, potency, purity, standard and price, to protect against unfair trade practices (e.g. MRP and expiry date on a pack).
3. Right to choose – access to a variety of goods and services at competitive prices.
4. Right to be heard – consumers' interests will receive due consideration at appropriate forums.
5. Right to seek redressal – against unfair or restrictive trade practices and unscrupulous exploitation.
6. Right to consumer awareness – the right to be educated about consumer rights.

Consumer Dispute Redressal Commission: Procedure

The Act sets up a three-tier quasi-judicial system: District Commission, State Commission and National Commission.

Procedure on a complaint:

1. Filing – complaint filed (offline or online through e-Daakhil) where the opposite party resides/works or where the complainant resides/works or where the cause arose.
2. Limitation – within two years from the date the cause of action arose (Section 69); delay can be condoned for sufficient cause.
3. Admission – the Commission decides whether to admit, normally within 21 days.
4. Notice – a copy is sent to the opposite party, who must reply within 30 days (extendable by 15 days).
5. Mediation – if both parties agree, the matter may go to the mediation cell.
6. Testing – if goods need testing, a sample is sent to an appropriate laboratory.
7. Decision – the complaint should be decided within 3 months of notice (5 months if testing is needed).

Appeals: District → State within 45 days; State → National within 30 days; National → Supreme Court within 30 days. When the appellant must pay money under the order, a part deposit (50% for appeals from the District Commission) is needed before appeal.

District, State and National Commissions: Constitution, Powers and Functions

*Limits as revised by the Consumer Protection (Jurisdiction of the District Commission, the State Commission and the National Commission) Rules, 2021 – check latest.

Powers: the Commissions have the powers of a civil court under the Code of Civil Procedure – summoning parties and witnesses, examining them on oath, calling for documents and evidence, and ordering laboratory tests. State and National Commissions can also hear appeals, call for records of lower Commissions (revision) and declare unfair contract terms void.

Functions / reliefs it can order: remove the defect; replace the goods; refund the price; pay compensation for loss or injury; remove deficiency in service; stop the unfair trade practice; withdraw hazardous goods from sale; issue corrective advertisement; pay punitive damages; pay costs.

Fines and Penalties under the Act

Likely exam questions

1. (Long, 8/16 marks) Explain the objectives, scope and main provisions of the Consumer Protection Act, 2019.
2. (Long, 8/16 marks) Describe the constitution, powers and functions of the District, State and National Consumer Disputes Redressal Commissions, and state the procedure for filing a complaint.
3. (Short, 4 marks) Define 'consumer' under the Consumer Protection Act, 2019. Who is not a consumer?
4. (Short, 4 marks) State the six rights of consumers.
5. (Short, 4 marks) What is a misleading advertisement? State the penalty for it.

Syllabus topics (RTMNU)

• Scope, Objectives, Features and main provisions of the Act
• Digital (Electronic) Signature Certificate - meaning and Revocation of Digital Signature Certificate
• Certifying Authority – meaning and Licensing of Certifying authority
• Attribution of Electronic record
• Electronic Governance
• Subscriber and its Duties
• Offences (Cyber Crime) and penalties under the Act

IT Act 2000: Scope, Objectives, Features and Main Provisions

The Information Technology Act, 2000 is India's main law on electronic transactions and cyber crime. It came into force on 17 October 2000 and was strongly amended by the IT (Amendment) Act, 2008 (in force from 27 October 2009). It is based on the UNCITRAL Model Law on Electronic Commerce.

Scope: it extends to the whole of India and also to offences committed outside India by any person if the act involves a computer or network located in India. It does not apply to negotiable instruments (other than cheques), powers of attorney, trusts, wills, and contracts for sale or transfer of immovable property (First Schedule).

Objectives:

1. Give legal recognition to electronic records and digital/electronic signatures.
2. Promote e-commerce and e-governance.
3. Allow electronic filing of documents with government offices.
4. Provide a system of Certifying Authorities for issuing signature certificates.
5. Define cyber crimes and provide penalties and punishment.
6. Amend the Indian Evidence Act, IPC, Bankers' Books Evidence Act and RBI Act to accept electronic records (these have since been replaced by the new criminal laws of 2023 – check latest).

Main features/provisions: legal recognition of e-records (Sec 4) and e-signatures (Sec 5); Controller of Certifying Authorities (Sec 17); civil penalties and compensation (Sec 43, 43A); offences (Sec 65–74); adjudicating officers (Sec 46); appeals to the Appellate Tribunal (now TDSAT, after the Finance Act 2017 merged the Cyber Appellate Tribunal into it); CERT-In as the national agency for cyber incidents (Sec 70B); and safe-harbour protection for intermediaries who follow due diligence (Sec 79).

Digital (Electronic) Signature Certificate: Meaning and Revocation

Digital signature [Sec 2(1)(p), Sec 3]: authentication of an electronic record by a subscriber using an asymmetric crypto system (a private key to sign and a public key to verify) and a hash function. The 2008 amendment added the wider term electronic signature (Sec 3A), which also covers e-sign methods such as Aadhaar e-Sign.

Digital/Electronic Signature Certificate (DSC): an electronic certificate issued by a licensed Certifying Authority under Sec 35 which confirms that a particular public key belongs to a particular person. It is like an electronic identity card. Example: companies use Class 3 DSCs for MCA filings and e-tenders; taxpayers use them for income-tax and GST returns.

Suspension (Sec 37): a CA may suspend a certificate for up to 15 days on the request of the subscriber, or if it believes the certificate should be suspended in public interest.

Revocation (Sec 38): a CA may revoke a DSC –

1. when the subscriber requests it;
2. on dissolution of the firm or winding up of the company that is the subscriber;
3. when a material fact in the certificate is false;
4. when a requirement for issue was not satisfied;
5. when the private key or security system has been compromised;
6. when the subscriber is declared insolvent or dies.

A certificate cannot be revoked without giving the subscriber an opportunity of being heard (except when revoked on his own request). Notice of suspension or revocation must be published in the CA's repository (Sec 39).

Certifying Authority: Meaning and Licensing

Certifying Authority (CA) [Sec 2(1)(g)]: a person who has been granted a licence to issue electronic signature certificates under Sec 24. Examples: eMudhra, (n)Code Solutions, Sify, and government CAs like NIC.

The Controller of Certifying Authorities (CCA), appointed by the Central Government under Sec 17, licenses and supervises CAs, sets their standards and maintains a database of certificates.

Licensing steps:

1. Application (Sec 22) – in the prescribed form with a certification practice statement, identity proof and fee.
2. Eligibility (Sec 21) – the applicant must meet requirements of qualification, expertise, manpower, financial resources and infrastructure.
3. Grant or rejection (Sec 24) – the Controller grants the licence or rejects after giving a reasonable opportunity of being heard.
4. Validity and renewal (Sec 23) – licence valid for the prescribed period; renewal application at least 45 days before expiry.
5. Suspension/revocation (Sec 25) – for false information, breach of terms or of the Act, after inquiry.

Attribution of Electronic Record

Attribution (Sec 11) decides who sent an electronic record. An e-record is attributed to the originator if it was sent:

1. by the originator himself;
2. by a person authorised to act for the originator; or
3. by an information system programmed by or on behalf of the originator to operate automatically.

Related rules: acknowledgement of receipt (Sec 12) and time and place of dispatch and receipt (Sec 13) – dispatch occurs when the record enters a computer resource outside the originator's control; the place is the parties' place of business. Example: an order sent automatically by a company's ERP is treated as sent by the company.

Electronic Governance

Chapter III (Sec 4–10A) gives legal force to e-governance:

• Sec 4 – legal recognition of electronic records: where law requires writing, an e-record is enough.
• Sec 5 – legal recognition of electronic signatures.
• Sec 6 – use of e-records in government: filing forms, issuing licences, receiving payments electronically.
• Sec 6A – delivery of services through authorised service providers (e.g. CSC centres).
• Sec 7 – retention of records in electronic form.
• Sec 8 – publication of rules and notifications in the Electronic Gazette.
• Sec 9 – no person can insist that a government department accept documents electronically.
• Sec 10A – contracts formed through electronic means are valid.

Examples: DigiLocker, GST portal, income-tax e-filing, e-Courts.

Subscriber and its Duties

Subscriber [Sec 2(1)(zg)]: a person in whose name the electronic signature certificate is issued.

Duties (Sec 40–42):

1. Generate key pair – generate the public and private key using the prescribed security procedure (Sec 40).
2. Acceptance – by accepting the certificate, the subscriber certifies that he holds the private key and that the information given is true (Sec 41).
3. Control of private key – take reasonable care to keep the private key secret; if it is compromised, inform the CA at once (Sec 42). Until he informs, he remains liable.

Offences (Cyber Crime) and Penalties

Civil wrongs: Sec 43 – damage to computer, unauthorised access, downloading data, introducing viruses → compensation to the affected person. Sec 43A – a body corporate negligent in protecting sensitive personal data → compensation (this section is to be omitted by the DPDP Act, 2023 – check latest).

Likely exam questions

1. (Long, 8/16 marks) Explain the objectives, scope and main features of the Information Technology Act, 2000.
2. (Long, 8/16 marks) What is a cyber crime? Explain the major offences and penalties under the IT Act, 2000.
3. (Short, 4 marks) What is a Digital Signature Certificate? When can it be revoked?
4. (Short, 4 marks) Explain the provisions regarding attribution of electronic records.
5. (Short, 4 marks) State the duties of a subscriber under the IT Act.

Syllabus topics (RTMNU)

• Definition of important terms – Content descriptor, Digital descriptor, user, online game, Social Media Intermediary
• Due Diligence by Intermediaries
• Additional due diligence
• Grievance Redressal Mechanism: Level-I, II & III
• Code of Ethics for: News and current affairs
• Online Curated content – General principles and content classification, Display of classification, restriction of access to certain curated content by a child

Intermediary means any person who, on behalf of another, receives, stores or transmits electronic records or provides a service for them – e.g. telecom companies, internet providers, search engines, social media platforms, online marketplaces. An intermediary gets "safe harbour" (no liability for third-party content) under Sec 79 only if it follows the due diligence in these Rules.

The Rules have three parts: Part II – due diligence by intermediaries (administered by MeitY); Part III – Code of Ethics for digital news publishers and OTT platforms (administered by the Ministry of Information and Broadcasting, MIB).

Definitions of Important Terms

1. Content descriptor – the issues and concerns relevant to the classification of online curated content, such as discrimination, drugs, alcohol or tobacco, imitable behaviour, language, nudity, sex, violence, fear, threat or horror. It tells the viewer why a show has a certain age rating.
2. Digital media (digital descriptor) – digitised content that can be transmitted over the internet or computer networks, including content received, stored or transmitted by an intermediary or a publisher of news or online curated content.
3. User – any person who accesses or uses a computer resource of an intermediary or publisher for hosting, publishing, sharing, viewing, downloading or uploading information, including persons jointly using it.
4. Online game (added in 2023) – a game offered on the internet and accessible by a user through a computer resource or an intermediary. Note: the Promotion and Regulation of Online Gaming Act, 2025 now bans online money games – check latest.
5. Social media intermediary (SMI) – an intermediary that primarily or solely enables online interaction between two or more users and allows them to create, upload, share, modify or access information (e.g. Facebook, Instagram, X, ShareChat).
6. Significant social media intermediary (SSMI) – an SMI with registered users in India above the threshold notified by the government (50 lakh users – check latest).

Due Diligence by Intermediaries (Rule 3)

1. Publish rules – display rules and regulations, privacy policy and user agreement on the website/app, in English or any Eighth Schedule language.
2. Inform users not to host, upload or share information that belongs to another person, is obscene, harmful to children, infringes patent/copyright, deceives or spreads misinformation, impersonates another, threatens India's unity, integrity, security or public order, contains viruses, or violates any law.
3. Remove unlawful content within 36 hours of a court order or notice from the appropriate government.
4. Periodic reminder to users (at least once a year) about the rules and that access can be terminated for non-compliance.
5. Retain information of removed content and user registration for 180 days for investigation.
6. Help law enforcement – give information or assistance to authorised agencies within 72 hours of an order.
7. Cyber security – take reasonable security measures and report cyber incidents to CERT-In.
8. Grievance Officer – appoint one and publish his name and contact details.
9. Intimate images – remove content showing a person's private parts or impersonation in sexual acts within 24 hours of a complaint.

Additional Due Diligence by Significant Social Media Intermediaries (Rule 4)

1. Chief Compliance Officer – resident in India, responsible for compliance with the Act and Rules.
2. Nodal Contact Person – resident in India, for 24×7 coordination with law enforcement agencies.
3. Resident Grievance Officer – resident in India.
4. Monthly compliance report – giving details of complaints received, action taken, and content removed proactively.
5. First originator – SSMIs mainly providing messaging (e.g. WhatsApp) must enable identification of the first originator of a message when ordered by a court or competent authority, for serious offences (sovereignty, security, public order, rape, child sexual abuse material) punishable with at least 5 years' imprisonment. (WhatsApp has challenged this in court – check latest.)
6. Technology tools – endeavour to use automated tools to identify child sexual abuse and rape content.
7. Physical contact address in India published on the website/app.
8. Voluntary verification – users may verify their accounts and get a visible verification mark.
9. Notice to user – before removing a user's content on its own, inform the user with reasons and allow a chance to dispute.

Grievance Redressal Mechanism: Level I, II and III

For intermediaries: the Grievance Officer must acknowledge a complaint within 24 hours and resolve it within 15 days. Since the 2022 amendment, a user unhappy with the decision can appeal within 30 days to a Grievance Appellate Committee (GAC) set up by the Central Government, which tries to decide within 30 days.

For digital news publishers and OTT platforms (three-tier structure):

Code of Ethics for News and Current Affairs

Publishers of digital news must follow:

1. the Norms of Journalistic Conduct of the Press Council of India (under the Press Council Act, 1978);
2. the Programme Code under Section 5 of the Cable Television Networks (Regulation) Act, 1995;
3. no content that is prohibited under any law in force.

So online news portals follow the same standards of accuracy, fairness and decency as newspapers and TV channels.

Online Curated Content: General Principles and Classification

Online curated content means audio-visual content such as films, web series, podcasts and documentaries, made available on demand by a publisher (OTT platforms like Netflix, Amazon Prime Video, JioHotstar).

General principles: do not transmit content prohibited by law; consider the effect of content on the sovereignty, integrity and security of India, friendly relations with other countries and public order; take due caution about the activities, beliefs and practices of any racial or religious group; and take into account India's multi-racial and multi-religious context.

Content classification (age ratings):

Display of classification: the rating and content descriptors must be shown prominently at the beginning of every programme and in its description, so the viewer can decide before watching.

Restriction of access by a child: for U/A 13+ or higher content, the platform must provide access control (parental lock); for "A" content it must have a reliable age-verification mechanism. Publishers should also try to improve accessibility for persons with disabilities.

Likely exam questions

1. (Long, 8/16 marks) Explain the due diligence and additional due diligence to be observed by intermediaries and significant social media intermediaries under the IT Rules, 2021.
2. (Long, 8/16 marks) Describe the three-level grievance redressal mechanism and the Code of Ethics for online curated content under the IT Rules, 2021.
3. (Short, 4 marks) Define: (a) Social media intermediary (b) Content descriptor.
4. (Short, 4 marks) What is a Grievance Appellate Committee?
5. (Short, 4 marks) State the content classification categories for online curated content.

Syllabus topics (RTMNU)

• Objectives of the Act
• Important definition – Data Principal, person, Data Fiduciary, Personal Data
• General obligation of Data Fiduciary
• Rights and duties of Data Principal
• Data Protection Board of India – Powers, Functions and Procedure to be followed by Board

Introduction and Objectives of the Act

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first full law on protecting personal data. It received the President's assent on 11 August 2023. The DPDP Rules, 2025 were notified in November 2025 and bring the Act into force in phases over about 18 months – check latest dates.

Background: in Justice K.S. Puttaswamy v. Union of India (2017), the Supreme Court held that the right to privacy is a fundamental right under Article 21 of the Constitution. A data protection law was needed to give effect to this.

Objectives:

1. Protect privacy of individuals' digital personal data.
2. Lawful processing – data may be processed only for a lawful purpose, with consent or for certain "legitimate uses".
3. Accountability – make companies (Data Fiduciaries) responsible for safe handling of data.
4. Give rights to individuals – access, correction, erasure, grievance redressal and nomination.
5. Protect children's data – parental consent; no tracking or targeted ads at children.
6. Set up a regulator – the Data Protection Board of India – and impose heavy penalties for breaches.
7. Support the digital economy – clear rules that are simple to follow ("SARAL" design).

Applicability: digital personal data processed in India (collected online, or collected offline and later digitised), and processing outside India if it is for offering goods or services to people in India. It does not apply to data processed for personal or domestic purposes, or data made public by the person himself.

Important Definitions

1. Data Principal [Sec 2(j)] – the individual to whom the personal data relates. For a child (below 18 years) it includes the parents or lawful guardian; for a person with disability, the lawful guardian. Example: you are the Data Principal for your Aadhaar and mobile number.
2. Person [Sec 2(s)] – includes an individual, a Hindu Undivided Family, a company, a firm, an association of persons or body of individuals, the State, and every artificial juristic person.
3. Data Fiduciary [Sec 2(i)] – any person who alone or together with others decides the purpose and means of processing personal data. Example: a bank, Flipkart, a hospital, a college that collects student data.
4. Personal Data [Sec 2(t)] – any data about an individual who is identifiable by or in relation to such data. Example: name, phone number, address, photo, PAN, location data.

Other useful terms: Data Processor – a person who processes data on behalf of a Data Fiduciary (e.g. a cloud or payroll company); Consent Manager – a registered platform through which a Data Principal gives, manages and withdraws consent; personal data breach – unauthorised processing, loss of access, or disclosure that harms confidentiality, integrity or availability of data.

General Obligations of Data Fiduciary (Sec 8)

1. Full responsibility – the Data Fiduciary is responsible for compliance even if a Data Processor does the processing for it.
2. Lawful processing – process only with valid consent (after giving a clear notice – Sec 5, 6) or for a legitimate use (Sec 7).
3. Accuracy – ensure data is complete, accurate and consistent when it is used to make a decision about the person or shared with another Fiduciary.
4. Security safeguards – take reasonable security measures (technical and organisational) to prevent data breach.
5. Breach intimation – inform the Data Protection Board and each affected Data Principal of any personal data breach.
6. Erasure – delete data when the purpose is over or consent is withdrawn, unless law requires keeping it, and make its Processor delete it too.
7. Contact person – publish the business contact of a Data Protection Officer or a person who can answer questions on data processing.
8. Grievance redressal – set up an effective mechanism to handle Data Principals' complaints.

Extra duties: for children – verifiable parental consent and no tracking, behavioural monitoring or targeted advertising (Sec 9). A Significant Data Fiduciary (notified on the basis of volume and sensitivity of data) must appoint a Data Protection Officer based in India, an independent data auditor and carry out periodic Data Protection Impact Assessments (Sec 10).

Rights and Duties of Data Principal

Rights:

1. Right to access information (Sec 11) – get a summary of personal data processed, the processing activities and the identities of other Fiduciaries with whom data was shared.
2. Right to correction and erasure (Sec 12) – correct, complete, update or erase personal data.
3. Right of grievance redressal (Sec 13) – complain first to the Data Fiduciary or Consent Manager, then to the Board.
4. Right to nominate (Sec 14) – nominate another person to exercise rights in case of death or incapacity.
5. Right to withdraw consent – as easily as it was given (Sec 6).

Duties (Sec 15):

1. Follow all applicable laws while exercising rights.
2. Not impersonate another person while giving data.
3. Not suppress any material information while giving data for an official document or ID.
4. Not file a false or frivolous grievance or complaint.
5. Give only verifiably authentic information when asking for correction or erasure.

Breach of these duties can attract a penalty of up to ₹10,000.

Data Protection Board of India: Powers, Functions and Procedure

Constitution (Sec 18–19): established by the Central Government; consists of a Chairperson and members appointed by the Central Government, persons of ability with knowledge of data governance, law, social or consumer protection, etc. They hold office for 2 years and can be reappointed.

Powers and functions (Sec 27):

1. On a personal data breach, direct urgent remedial or mitigation measures and inquire into it.
2. Inquire into complaints by Data Principals and references from the government or a court.
3. Inquire into breaches by Consent Managers and take action, including on their registration.
4. Impose monetary penalties as per the Schedule.
5. Direct parties to mediation (Sec 31) and accept a voluntary undertaking from a Fiduciary (Sec 32).
6. Advise the government to block a Fiduciary's platform after repeated penalties (Sec 37).

Procedure (Sec 28): the Board works as an independent body and as a digital office (online complaints, hearings and orders). It first decides if there are sufficient grounds for inquiry; it may close the case if not. During inquiry it has the powers of a civil court (summon and examine persons on oath, ask for documents, inspect data). It must follow natural justice and record reasons. Penalty is fixed after considering the nature, gravity and duration of the breach, the type of data affected, repetition, gains made and steps taken to reduce harm (Sec 33).

Appeal (Sec 29): against an order of the Board to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days; TDSAT tries to decide within 6 months.

Likely exam questions

1. (Long, 8/16 marks) Explain the objectives of the Digital Personal Data Protection Act, 2023 and the general obligations of a Data Fiduciary.
2. (Long, 8/16 marks) Describe the powers, functions and procedure of the Data Protection Board of India.
3. (Short, 4 marks) Define: (a) Data Principal (b) Data Fiduciary (c) Personal Data.
4. (Short, 4 marks) State the duties of a Data Principal under the DPDP Act, 2023.
5. (Short, 4 marks) State any four rights of a Data Principal.