Right Without Remedy: A Doctrinal Critique Of The Data Protection Board of India

Abstract

The Digital Personal Data Protection Act, 2023 (DPDPA), establishes the Data Protection Board of India (DPB) as the primary adjudicating body for data privacy disputes. Unlike other major data protection jurisdictions with investigative, supervisory, and legislative authority, the DPB is a is a lean, penaltyfocused body that operates under the executive branch's authority. This article examines three predominant issues of the DPB that undermine effective exercise of statutory rights to obtain meaningful redressal. Firstly, it evaluates the structure of the DPB, including its appointment, two-year tenure, its digitalised proceedings, and how appeals to TDSAT are delegated. These features are critically assessed in light of judicial independence and procedural fairness under Articles 14 and 21 of the Constitution. Second, it analyses the inadequacies of the evidentiary framework by identifying critical gaps in the burden of proof, particularly regarding consent managers and conflicting data minimization obligations that places unfair disadvantage on data fiduciaries. Third, it examines the DPB's remedial framework, establishing that removal of individual's right to compensation given under Section 43A of the Information Technology Act, 2000, the DPDPA leaves affected data principals with no avenue for personal relief beyond the imposition of penalties on the violator. Through doctrinal analysis, judicial precedents, and a comparative analysis with other jurisdiction models across the dimensions of institutional independence, burden of proof and individual compensation. This article demonstrates that India's enforcement model fails to provide effective redressal mechanism to aggrieved data principals, which creates a structural gap between the right to complain and the right to justice.