In short: A DPDP data protection board complaint lets you seek redress when your personal data rights are violated under the Digital Personal Data Protection Act, 2023. Before you approach the Board, you must first raise a grievance with the company (Data Fiduciary) that processed your data and wait for their response.
Key points
- The Digital Personal Data Protection Act, 2023 was published on 11 August 2023; the DPDP Rules were notified on 13 November 2025 and published in the Gazette on 14 November 2025.
- The Data Protection Board of India (DPBI) was formally established on 13 November 2025 under Section 18 of the DPDP Act, but as of mid-2026 it is not yet fully operational because all Chairperson and Member appointments had not been completed.
- Before filing with the Board, you must first raise your grievance with the Data Fiduciary (the company or entity that processed your data) and allow up to 90 days for a response.
- Complaints will be filed and tracked entirely online through a dedicated portal and mobile application — no physical appearance required.
- The Board can hear complaints about personal data breaches and failures by Data Fiduciaries or Consent Managers to meet their legal obligations.
- Appointment of Board leadership was still ongoing as of May 2026, meaning complaints cannot yet be formally lodged before a fully constituted Board.
What is the Data Protection Board of India?
The Data Protection Board of India (DPBI) is the adjudicating body created by the DPDP Act, 2023. It is India’s dedicated forum for resolving complaints about misuse of personal data.
Unlike a traditional court, the DPBI is designed to function as a fully digital office. Proceedings are conducted without requiring you to appear in person, though the Board retains the power to summon individuals and examine them on oath when necessary.
The Board will consist of four members, including a Chairperson. Two Search-cum-Selection Committees — one chaired by the Cabinet Secretary for the Chairperson, and another chaired by the Secretary of MeitY for other Members — are responsible for recommending appointments.
Is the Board accepting complaints right now?
Not yet. Although the DPBI was formally established in November 2025, the appointment of its Chairperson and all Members was still in progress as of May 2026. A MeitY circular dated 6 May 2026 confirms the appointment process was ongoing at that time.
This means the Board is not yet fully operational. You should monitor official MeitY announcements for updates before attempting to file a complaint. In the meantime, the mandatory pre-complaint steps described below still apply and are worth completing now.
Who can file a DPDP data protection board complaint?
You can file a complaint if you are a Data Principal — that is, the individual whose personal data has been collected or processed. In plain terms, this covers almost any Indian resident whose data has been handled by an app, website, bank, hospital, employer, or any other organisation.
Complaints can also reach the Board through references from the Central or State Government or by order of a court.
What can you complain about?
The Board can hear your complaint if you allege a personal data breach — meaning your data was exposed, misused, or accessed without authorisation. It can also hear complaints about a Data Fiduciary or Consent Manager failing to observe their legal obligations under the Act.
Examples of such failures include a company not honouring your right to access your data, not erasing data on request, or not obtaining valid consent before processing your information.
The mandatory pre-condition: exhaust the internal grievance mechanism first
This is the most important step and one many people overlook. The DPDP Act makes it a legal requirement — not just a suggestion — that you raise your grievance with the Data Fiduciary before approaching the Board.
Here is how the three-step sequence works under the Act:
| Step | What you do | Legal basis |
|---|---|---|
| 1 | Submit a grievance to the Data Fiduciary (the company that processed your data) in the prescribed manner. | Section 13(1) of the DPDP Act |
| 2 | Wait for the Data Fiduciary’s response. The prescribed period is typically 90 days. If you receive no response or an unsatisfactory one, you may proceed. | Section 13(2) of the DPDP Act |
| 3 | File your complaint with the Data Protection Board of India through the online portal. | Section 13(3) of the DPDP Act |
The Act explicitly states that you must exhaust the internal grievance opportunity before approaching the Board. If you skip this step, your complaint is unlikely to be entertained.
How to raise a grievance with the Data Fiduciary
Every Data Fiduciary subject to the DPDP Act is required to maintain a grievance redressal mechanism. Look for a “Grievance Officer” contact, a dedicated email address, or a complaint section within the platform’s privacy policy or settings.
Send your grievance in writing (email is sufficient) and keep a record of the date and the content of your message. This documentation will be important if you later need to show the Board that you raised the matter and were not satisfied with the response.
How to file the complaint with the Board
Once you have completed the internal grievance step and remain dissatisfied (or received no response within the prescribed period), you can file a DPDP data protection board complaint through the dedicated online portal and mobile application that the Board will operate.
The process is designed to be entirely digital. You will be able to file your complaint, submit documents, and track your case status online — all without needing to visit any office or appoint a lawyer to appear in person on your behalf (though legal advice is always sensible for complex matters).
Since the Board is not yet fully operational, the complaint portal is not yet live. Keep checking the MeitY website and official DPBI communications for the launch date and detailed filing instructions.
Practical steps to prepare right now
Even before the portal goes live, you can use this time productively. Raise your grievance with the Data Fiduciary now so that the 90-day clock starts running. Document every interaction. Collect evidence of the data breach or rights violation — screenshots, emails, notices — and organise them for upload.
For guidance on other consumer and citizen legal rights in plain language, explore our Law for You guides at The Courtroom, which cover a range of everyday legal situations in India.
Frequently asked questions
Can I file a DPDP data protection board complaint directly without contacting the company first?
No. The DPDP Act makes it a legal requirement to first raise a grievance with the Data Fiduciary (the company that processed your data) and allow the prescribed period — typically 90 days — for a response. Only after that process is exhausted, or if you receive an unsatisfactory response, can you approach the Board. Skipping this step means your complaint will not be entertained.
Is the Data Protection Board of India accepting complaints right now?
Not yet. The DPBI was formally established in November 2025 but is not fully operational because the Chairperson and all Members had not been appointed as of mid-2026. A MeitY circular from May 2026 confirms appointments were still in progress. Monitor official MeitY announcements for updates on when the Board will begin hearing complaints.
Do I need to appear in person before the Data Protection Board?
Generally, no. The DPDP Rules require the Board to function as a fully digital office, and proceedings are designed to take place without physical presence. You will file your complaint and track its progress through an online portal and mobile application. The Board does, however, retain the power to summon individuals and examine them on oath if required in a particular case.
This article is for general information only and is not legal advice. Laws change; verify against the primary sources cited and consult a qualified advocate for your situation.
