Sections 18-42 of DPDP Act 2023 establish the regulatory architecture for enforcement. Section 18 Establishment of Data Protection Board of India (DPBI): a Board to be called the Data Protection Board of India + body corporate + perpetual succession + common seal + power to acquire/hold/dispose of property + contract + sue and be sued. DPBI headquartered in Delhi-NCR + may have other offices + as the Government may decide. Section 19-22 Composition + Service Conditions: DPBI consists of Chairperson + other Members (number prescribed by Government); appointed by Central Government from candidates with specialised knowledge of data governance + economics + privacy + technology + administration + law + or related disciplines; Chairperson + Members hold office for 2 years (eligible for reappointment); salary + allowances prescribed by Government. Section 23-26 Functions of DPBI: shall be a digital office (no requirement to be physically present in person before the Board); receive complaints + conduct inquiries + impose financial penalties + cooperate with authorities + advise on data governance matters + adjudicate. Section 27 Inquiry Process: DPBI may direct any urgent remedial or mitigative measures during the course of an inquiry. Section 28-30 Powers of Civil Court: DPBI vested with same powers as a civil court (summoning + requiring production of documents + on-oath examination + commission). Section 31 Adjudication: penalties prescribed per Schedule based on facts and circumstances - factors include nature + gravity + duration + repetition + impact + mitigation. Section 32 Voluntary Undertaking: DPBI may accept written voluntary undertaking from any person at any stage + relating to matter under proceedings + on terms accepted by DPBI such undertaking shall bar instituting any proceedings under this Act + the breach of the undertaking would itself be a penalty offence. Section 33-37 Appeals: appeals from DPBI orders lie to Telecom Disputes Settlement and Appellate Tribunal (TDSAT) which acts as the Appellate Tribunal under DPDP within 60 days + further appeal to Supreme Court on question of law. Section 38 Composition of Offences: certain offences compoundable on payment of sum. Schedule Penalties (illustrative, full schedule in Act): up to INR 250 crore for failure of Data Fiduciary to take reasonable security safeguards to prevent personal data breach + up to INR 200 crore for breach in obligations of Data Fiduciary to give notice to Board and affected Data Principals of a personal data breach + up to INR 200 crore for breach in obligations regarding children + up to INR 150 crore for breach in obligations regarding SDF additional measures + up to INR 50 crore for breach in obligations regarding consent + up to INR 10000 for non-compliance by Data Principal (against the duty in Section 15) - paid to the Consolidated Fund of India. Section 40-42 Power of Central Government to make Rules + Frame Issues + Supersede; remove difficulties; etc. Operational implementation: penalty risk assessment + DPBI engagement playbook + cooperation + voluntary undertaking strategy + appeals to TDSAT counsel + records + post-incident remediation + harm prevention + customer compensation. Coordinates with RBI Integrated Ombudsman Scheme (cross-jurisdiction with DPDP grievance) + TDSAT (already handling telecom + broadcasting + cyber under IT Act 2000 Section 14 + 14A) + I4C cybercrime.gov.in + Consumer Protection Act 2019 + GDPR EU Data Protection Board + UK ICO + Singapore PDPC + Australia OAIC + EU CSDDD + India national cybersecurity strategy. DPDP Sec 18-42 DPBI + Enforcement applies.
This control maps to 28 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 28 it maps to, and the evidence behind each claim, over MCP and REST.