NEW DELHI, October 18 — The Ministry of Electronics and Information Technology (MeitY) officially notified the comprehensive operational regulations and grievance redressal charter for the Data Protection Board of India under the Digital Personal Data Protection (DPDP) Act on Sunday.
Under the notified procedural rules, all data fiduciaries operating across digital domains must establish automated grievance resolution mechanisms obligated to resolve citizen (Data Principal) requests concerning consent revocation, data erasure, or identity correction within a strict 72-hour statutory window. Aggrieved citizens can escalate unresolved complaints or unreported personal data breach incidents directly to the digital appellate interface of the Data Protection Board.
MeitY emphasized that the DPDP enforcement architecture empowers the Board to levy graded financial penalties reaching up to ₹250 Crore for systemic security failures or intentional concealment of breaches, while mandating verifiable parental consent for processing minors’ data and periodic independent audits for Significant Data Fiduciaries (SDFs).
The legal evolution of privacy rights in India (Justice K.S. Puttaswamy v. Union of India 2017 establishing privacy as a fundamental right under Article 21), recommendations of the Justice B.N. Srikrishna Committee, comparative analysis with the EU General Data Protection Regulation (GDPR), and statutory powers of the Data Protection Board are central themes in UPSC GS-II and GS-III.