Skip to main content

Q3 - How does the appeal process to the Appellate Tribunal work in practice?

Answer

If a company, individual, or Consent Manager disagrees with a decision made by the Data Protection Board of India (DPBI) — for example, a penalty, directive, or interim order — they can appeal to the Appellate Tribunal. The appeal mechanism under the Digital Personal Data Protection Act, 2023 (DPDPA) is designed to ensure independent, fair, and time-bound review of the Board’s decisions.

Section 29(1) —
Any person aggrieved by an order or direction made by the Board may prefer an appeal before the Appellate Tribunal.

This means any affected party — whether a company (Data Fiduciary or Processor), an individual (Data Principal), or a Consent Manager — can file an appeal if they believe the Board’s order is unjust, excessive, or incorrect in fact or law.

2. Timeline for Filing an Appeal​

Section 29(2–3) —

  • An appeal must be filed within 60 days from the date of receiving the Board’s order.
  • The Tribunal may allow late filing if there is “sufficient cause” for the delay, such as pending evidence, system issues, or unavoidable circumstances.

This ensures that appellants get a reasonable window to prepare a factual and legal challenge.

3. Where and How to File​

In practice, the Appellate Tribunal is expected to be the same body as the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) — designated to hear DPDPA appeals until a dedicated Data Protection Tribunal is formally established.

Filing steps:

  1. Submit an Appeal Petition in the prescribed form (to be notified in DPDPA Rules).
  2. Attach the impugned Board order, supporting documents, and proof of payment of the prescribed appeal fee.
  3. Serve a copy of the appeal to the DPBI and any other parties involved.
  4. Provide a verified statement of facts, legal grounds, and requested relief (e.g., penalty reduction, order reversal, or stay).

4. What Happens After Filing​

Section 29(4) —
The Tribunal, after giving all parties an opportunity to be heard, may:

  • Confirm the Board’s order,
  • Modify it (e.g., reduce penalty), or
  • Set it aside entirely.

In most cases, the Tribunal:

  • Issues notices to both parties (appellant and DPBI).
  • Schedules a hearing where both sides can present evidence and arguments.
  • Examines procedural fairness, proportionality of penalties, and whether due process was followed by the Board.
  • May grant interim relief (such as staying a penalty) while the appeal is pending.
Example

A fintech startup receives a ₹15 crore penalty for delayed breach notification. The company appeals to the Tribunal, presenting server logs showing the breach was reported within 6 hours to CERT-In and the DPBI. After review, the Tribunal reduces the penalty, citing good-faith compliance and technical proof.

5. Timeframe for Decision​

Section 29(6) —
The Tribunal must aim to dispose of appeals within six months from the date of filing.

Section 29(7) —
If it cannot do so, the Tribunal must record reasons in writing for the delay.

This ensures accountability and avoids indefinite pendency of appeals — a major step toward faster data-protection adjudication.

6. Post-Appeal Options​

Once the Tribunal issues its decision:

  • Either party (the company or the Board) may accept and comply, or
  • If dissatisfied, may challenge the Tribunal’s order before the High Court under general judicial-review powers (Article 226/227 of the Constitution of India).

7. Practical Tips for Companies​

To strengthen an appeal:

  1. Maintain detailed documentation during the Board inquiry (emails, audit logs, notices).
  2. Engage legal counsel experienced in data protection and administrative law.
  3. File appeals digitally and promptly, ensuring all procedural steps are met.
  4. Request interim relief if the Board’s order causes immediate harm (e.g., business disruption).
  5. Preserve records of mitigation steps (security upgrades, user notifications) — they often influence the Tribunal’s decision.

8. Key Takeaway​

  • The Appellate Tribunal provides an independent, quasi-judicial layer of review for DPDPA cases.
  • Appeals must be filed within 60 days (extendable).
  • Companies can contest evidence, present new material, and seek interim relief.
  • Decisions are typically expected within six months, ensuring timely resolution and procedural fairness.

Referenced Provisions:

  • Section 29(1–7) – Appeal to Appellate Tribunal.
  • Section 28(10–11) – Hearing and due-process rights before final Board orders.
  • Code of Civil Procedure, 1908 – Evidentiary and procedural powers of the Board and Tribunal.