Section 27 — Powers and Functions of Board

Sections 18 through 26 set up the Board as an institution — its composition, tenure, and the Chairperson's administrative authority. Section 27 is where the Board starts actually doing something with that authority. It lists the specific ways a matter can land on the Board's desk, and what the Board is entitled to do once it has.

Five ways a matter reaches the Board — 27(1)(a)-(e)

Clause (a) is the only one that doesn't wait for anyone to complain: on receipt of a personal data breach intimation under Section 8(6), the Board can direct urgent remedial or mitigation measures, inquire into the breach, and impose a penalty. The other four clauses are all complaint- or reference-driven. Clause (b) covers a Data Principal's complaint about a personal data breach, or about a Data Fiduciary failing to observe its obligations toward her data or her rights — and it extends the same trigger to a reference from the Central or State Government, or a court's direction. Clause (c) covers a Data Principal's complaint about a Consent Manager's conduct. Clause (d) covers an intimation that a Consent Manager has breached a condition of its own registration. And clause (e) covers a Central Government reference about an intermediary's breach of Section 37(2). In every case, the outcome the Act names is the same: inquire, and impose penalty as provided elsewhere in the Act.

The Consent Manager clauses matter because they're the reason a Consent Manager's exposure to Board action runs on a separate track from a Data Fiduciary's — the Penalties & Enforcement FAQs cover how that plays out for a registered Consent Manager specifically.

Binding directions beyond a single inquiry — 27(2)

Separately from any specific breach or complaint, the Board may issue directions it considers necessary "for the effective discharge of its functions" under the Act — but only after giving the person concerned an opportunity of being heard, and only after recording its reasons in writing. Once issued, the person is bound to comply. This is a broader power than the case-specific inquiries in 27(1): it lets the Board act on something it judges necessary for the Act to function properly, not only in response to a named breach.

Revisiting its own directions — 27(3)

A direction under 27(1) or 27(2) isn't necessarily final. On a representation from the person affected by it, or on a reference from the Central Government, the Board may modify, suspend, withdraw or cancel the direction — and it can attach fresh conditions to whichever of those it chooses. This gives an affected party a route back to the Board itself, short of a full appeal to the Appellate Tribunal under Section 29.

Why this matters in practice

Section 27 is the section that decides whether a matter reaches the Board proactively (through your own breach intimation under 8(6)) or reactively (through someone else's complaint). Both routes end at the same inquiry machinery, which Section 28 spells out in detail, and the same penalty regime under Section 33 — so the practical difference isn't how seriously the Board treats the two paths, it's how much warning you get. A breach intimation you file yourself means you already know an inquiry may follow; a complaint filed against you can arrive with no advance notice at all.

Illustration: a Data Fiduciary notifies the Board of a personal data breach under 8(6). That intimation alone is enough to trigger 27(1)(a) — the Board can direct immediate mitigation steps and open an inquiry without waiting for any Data Principal to file a separate complaint. Months later, if a different Data Principal complains that the same Fiduciary never actually fixed her specific grievance, that complaint reaches the Board through 27(1)(b) instead — a second, independent route into the same underlying failure.

How Section 27 connects to the rest of the Act

Section 8(6)'s breach-intimation duty is what feeds 27(1)(a) directly. Section 6(9)'s Consent Manager registration is what 27(1)(c) and (d) police. Section 28 is the procedure the Board actually follows once any of these five triggers puts a matter before it, and Section 33 is where the penalty that 27(1) refers to gets quantified against the Schedule's factors. Section 29 gives anyone aggrieved by a direction under 27(2) or 27(3) somewhere further to go — an appeal to the Appellate Tribunal.