Sections 18-42 of DPDP Act 2023 establish the regulatory architecture for enforcement. Section 18 Establishment of Data Protection Board of India (DPBI): a Board to be called the Data Protection Board of India + body corporate + perpetual succession + common seal + power to acquire/hold/dispose of property + contract + sue and be sued. DPBI headquartered in Delhi-NCR + may have other offices + as the Government may decide. Section 19-22 Composition + Service Conditions: DPBI consists of Chairperson + other Members (number prescribed by Government); appointed by Central Government from candidates with specialised knowledge of data governance + economics + privacy + technology + administration + law + or related disciplines; Chairperson + Members hold office for 2 years (eligible for reappointment); salary + allowances prescribed by Government. Section 23-26 Functions of DPBI: shall be a digital office (no requirement to be physically present in person before the Board); receive complaints + conduct inquiries + impose financial penalties + cooperate with authorities + advise on data governance matters + adjudicate. Section 27 Inquiry Process: DPBI may direct any urgent remedial or mitigative measures during the course of an inquiry. Section 28-30 Powers of Civil Court: DPBI vested with same powers as a civil court (summoning + requiring production of documents + on-oath examination + commission). Section 31 Adjudication: penalties prescribed per Schedule based on facts and circumstances - factors include nature + gravity + duration + repetition + impact + mitigation. Section 32 Voluntary Undertaking: DPBI may accept written voluntary undertaking from any person at any stage + relating to matter under proceedings + on terms accepted by DPBI such undertaking shall bar instituting any proceedings under this Act + the breach of the undertaking would itself be a penalty offence. Section 33-37 Appeals: appeals from DPBI orders lie to Telecom Disputes Settlement and Appellate Tribunal (TDSAT) which acts as the Appellate Tribunal under DPDP within 60 days + further appeal to Supreme Court on question of law. Section 38 Composition of Offences: certain offences compoundable on payment of sum. Schedule Penalties (illustrative, full schedule in Act): up to INR 250 crore for failure of Data Fiduciary to take reasonable security safeguards to prevent personal data breach + up to INR 200 crore for breach in obligations of Data Fiduciary to give notice to Board and affected Data Principals of a personal data breach + up to INR 200 crore for breach in obligations regarding children + up to INR 150 crore for breach in obligations regarding SDF additional measures + up to INR 50 crore for breach in obligations regarding consent + up to INR 10000 for non-compliance by Data Principal (against the duty in Section 15) - paid to the Consolidated Fund of India. Section 40-42 Power of Central Government to make Rules + Frame Issues + Supersede; remove difficulties; etc. Operational implementation: penalty risk assessment + DPBI engagement playbook + cooperation + voluntary undertaking strategy + appeals to TDSAT counsel + records + post-incident remediation + harm prevention + customer compensation. Coordinates with RBI Integrated Ombudsman Scheme (cross-jurisdiction with DPDP grievance) + TDSAT (already handling telecom + broadcasting + cyber under IT Act 2000 Section 14 + 14A) + I4C cybercrime.gov.in + Consumer Protection Act 2019 + GDPR EU Data Protection Board + UK ICO + Singapore PDPC + Australia OAIC + EU CSDDD + India national cybersecurity strategy. DPDP Sec 18-42 DPBI + Enforcement applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.