Section 28 — Procedure to be Followed by Board

Section 27 tells you what can land in front of the Board and what the Board is entitled to do about it. Section 28 tells you how it actually gets from there to a decision — the mechanics of an inquiry, from the moment something arrives to the moment the Board either closes the file or refers it onward to a penalty under Section 33.

An independent body, built to run digitally — 28(1)

The Board is described as an independent body that shall, "as far as practicable," function as a digital office — with complaint receipt, allocation, hearing and pronouncement of decisions being digital by design, using techno-legal measures still to be prescribed. That's a genuinely notable design choice: a regulator whose default posture is a digital-first process has real accessibility implications for a Data Principal who isn't comfortable navigating an online portal, and the "as far as practicable" qualifier suggests the drafters anticipated that tension without fully resolving it in the statute itself.

From receipt to a decision on whether to inquire — 28(2)-(5)

On receiving any of the five triggers listed in Section 27(1) — an intimation, complaint, reference or direction — the Board acts in accordance with the Act and its rules. Its first substantive decision is whether there are sufficient grounds to proceed with an inquiry at all. If it decides there aren't, it can close the proceedings, but only for reasons it records in writing. If it decides there are, it may inquire into the affairs of the person concerned to establish whether they're complying, or have complied, with the Act — again, for reasons recorded in writing. Both outcomes require a paper trail; neither is a decision the Board can make silently.

Natural justice and civil-court powers — 28(6)-(7)

Once an inquiry is underway, the Board has to follow the principles of natural justice and record reasons for its actions as the inquiry proceeds. For the purposes of that inquiry, it holds the same powers as a civil court under the Code of Civil Procedure, 1908, specifically over: summoning and enforcing attendance and examining a person on oath; receiving affidavit evidence and requiring discovery and production of documents; inspecting any data, book, document, register, or books of account; and whatever further matters get prescribed. This is what makes an inquiry more than an informal conversation — the Board can compel testimony and documents the way a court can, even though it isn't a court.

Limits on the Board's reach — 28(8)-(9)

Those powers have an explicit ceiling. The Board and its officers cannot prevent access to any premises, or take into custody any equipment or item, where doing so would adversely affect a person's day-to-day functioning — there's no raid-and-seize power written into this section that could shut an organisation's operations down mid-inquiry. Separately, the Board may call on police officers or Central or State Government officers to assist it, and those officers are under a duty to comply with that requisition.

Interim orders and closing the inquiry — 28(10)-(12)

If the Board considers it necessary during the course of an inquiry, it may issue interim orders — again with written reasons, and only after giving the person concerned a hearing. On completing the inquiry, and after another opportunity of being heard, the Board either closes the proceedings or moves ahead in accordance with Section 33's penalty provisions, with reasons recorded either way. And at any stage after a complaint is received, if the Board considers it false or frivolous, it can issue a warning or impose costs on the complainant — a check that runs in the opposite direction from every other power in this section.

Why this matters in practice

Section 28 is where most of the practical uncertainty in a Board inquiry actually sits, because so much of it depends on techno-legal measures and prescribed procedures the rules haven't fully fleshed out yet. What's already settled is the shape: an inquiry that runs primarily online, follows natural-justice safeguards, can compel documents and testimony, but can't physically disable your operations to do it. Being on the receiving end of a 28(5) inquiry is a materially different position from being on the receiving end of a false-complaint warning under 28(12) — and an organisation's actual exposure depends heavily on which side of that line a given matter falls.

Illustration: a Data Principal complains that a Data Fiduciary ignored her erasure request. The Board reviews the complaint under 28(3), decides there are sufficient grounds, and opens an inquiry under 28(5) — summoning the Fiduciary's records under its CPC-equivalent powers in 28(7). If the Fiduciary later shows the request was, in fact, honoured on time and the complaint was baseless, the Board can close the inquiry under 28(11) and, if it finds the complaint was made in bad faith, impose costs on the complainant under 28(12).

How Section 28 connects to the rest of the Act

Section 27(1) supplies the five triggers that start the process 28 governs. Section 28(11)'s decision to "proceed in accordance with section 33" is the doorway into the Act's penalty regime. Section 28(1)'s digital-office requirement is mirrored almost word for word in Section 29(10) for the Appellate Tribunal, and 28(7)'s civil-court powers at the inquiry stage sit alongside Section 30(1)'s decree-execution power for the Tribunal at the enforcement stage — different tools, calibrated to different phases of the same process.