The Central Government may make rules, after previous publication, for implementing the Digital Personal Data Protection Act, 2023. Rules may regulate Data Fiduciary notices, Consent Manager accountability and registration, personal data breach intimation, verifiable consent, children's data processing, Data Protection Impact Assessments, and obligations of Significant Data Fiduciaries. They may also prescribe procedures for Data Principal information and erasure requests, grievances, nominations, exempt processing standards, Board administration, techno-legal measures, and appeals.

Bar of civil court jurisdiction excludes suits or proceedings concerning matters within the Board's statutory powers. Courts and other authorities cannot grant injunctions against actions taken, or proposed to be taken, under powers conferred by the Digital Personal Data Protection Act, 2023. The provision takes effect from 13 November 2025.

Section 38 preserves the concurrent operation of other laws by providing that the Digital Personal Data Protection Act, 2023 applies in addition to, and does not derogate from, applicable law. Where its provisions conflict with another law in force, the Digital Personal Data Protection Act, 2023 prevails only to the extent of the conflict. The framework takes effect from 13 November 2025.

Section 37 permits the Central Government or a specially authorised officer to order public-access blocking of information on a computer resource enabling a Data Fiduciary to offer goods or services to Data Principals in India. The power requires a written Board reference concerning repeated monetary penalties and advice that blocking serves the general public interest. The Data Fiduciary must be heard, and written reasons must support the finding that blocking is necessary or expedient. Intermediaries receiving such directions must comply.

Section 36 empowers the Central Government to require the Board, any Data Fiduciary, or any intermediary to furnish information for the purposes of the Digital Personal Data Protection Act, 2023. This creates a statutory information-furnishing obligation for the Board and regulated entities when information is called for.

Section 35 provides good-faith protection to the Central Government, the Board, and their Chairperson, Members, officers and employees. It bars suits, prosecutions and other legal proceedings concerning acts done, or intended to be done, in good faith under the Digital Personal Data Protection Act, 2023 or rules made under it. The provision is to take effect on 13 November 2025.

Penalties imposed by the Board under the Digital Personal Data Protection Act, 2023 must be credited to the Consolidated Fund of India. All sums realised through such penalties are required to be deposited in that fund.

Significant breaches of the Digital Personal Data Protection Act, 2023 or its rules may result in a monetary penalty specified in the Schedule. The Board may impose the penalty only after completing an inquiry, determining that the breach is significant, and giving the concerned person an opportunity to be heard. Penalty assessment considers breach severity, affected personal data, repetition, gains or avoided losses, mitigation, proportionality, deterrence, and likely impact.

At any stage of proceedings, the Board may accept a voluntary undertaking concerning observance of the Digital Personal Data Protection Act, 2023. Terms may require action within a determined time, abstention from action, or publication. Acceptance bars further proceedings concerning the undertaking's contents, subject to non-compliance. Terms may be varied with the giver's consent. Breach of an accepted term is deemed a breach of the Act and may lead to proceedings after an opportunity of being heard.

Alternate dispute resolution permits the Board, where it considers a complaint capable of resolution by mediation, to direct the concerned parties to attempt mediated resolution. The mediator may be selected by mutual agreement of the parties or in accordance with any law in force in India governing such mediation.

Appellate Tribunal orders under digital personal data protection law are executable by the Tribunal as civil-court decrees, with all powers of a civil court available for execution. The Tribunal may transmit an order to the civil court having local jurisdiction, which must execute it as though it were its own decree.

Any person aggrieved by an order or direction of the Board may appeal to the Appellate Tribunal within sixty days, subject to prescribed form, manner, and fee requirements. The Tribunal may condone delay for sufficient cause and, after hearing the parties, confirm, modify, or set aside the challenged order. Appeals should be disposed of expeditiously, with reasons recorded for delay beyond six months. Proceedings should function as far as practicable through a digital office.

Bail in allegations of fraudulent loan transactions requires assessment of the prima facie case, offence gravity and societal impact, public interest, and the risk of interference with justice. Alleged concerted siphoning of co-operative bank funds through loans was treated as seriously affecting depositors and the banking system. Temporary bail intended to enable recovery had not resulted in recovery. Alleged influence of the accused, together with a genuine apprehension of evidence tampering and interference with pending proceedings, weighed against release. Bail was therefore denied.

The Board must function independently and, as far as practicable, as a digital office for digital receipt, allocation, hearing and decision-making. It must assess whether sufficient grounds justify an inquiry, record written reasons when closing or pursuing proceedings, and conduct inquiries under principles of natural justice. It has civil-court powers to summon persons, receive affidavit evidence, require documents and inspect records, while being barred from disrupting access to premises or taking custody of items that adversely affect day-to-day functioning. Interim orders and post-inquiry action require an opportunity of hearing.

The Board may order urgent remedial or mitigation measures for personal data breaches, investigate specified breaches involving Data Fiduciaries, Consent Managers and intermediaries, and impose statutory penalties. After hearing the concerned person and recording written reasons, it may issue binding directions. Directions may be modified, suspended, withdrawn or cancelled on representation by an affected person or on Central Government reference, subject to conditions imposed by the Board.

The Chairperson exercises general superintendence over the Board's administrative matters and may issue directions. Board officers may be authorised to scrutinise intimations, complaints, references and correspondence. The Chairperson may also authorise individual Members or groups of Members to perform Board functions and conduct proceedings, and may allocate proceedings among them.

Public-servant status is conferred on the Chairperson, Members, officers and employees of the Data Protection Board of India when acting, or purporting to act, under the Digital Personal Data Protection Act, 2023. They are deemed to be public servants for the purposes of the Indian Penal Code.

Section 24 authorises the Data Protection Board of India to appoint officers and employees necessary for efficient discharge of its functions, subject to prior approval of the Central Government. Prescribed terms and conditions govern appointment and service. The staffing framework takes effect from 13 November 2025.

The Board must follow prescribed procedures for meetings and business, including digital meetings, and authenticate its orders, directions and instruments as prescribed. Proceedings remain valid despite vacancies, constitutional or appointment defects, and non-merits procedural irregularities. If the Chairperson is unable to act owing to absence, illness or another cause, the senior-most Member performs the Chairperson's functions until duties resume.

Resignation by the Chairperson or any other Member becomes effective upon the earliest specified event, including permission to relinquish office, lapse of three months, appointment of a successor, or expiry of term. Vacancies must be filled by fresh appointment. Former office-holders are subject to a one-year post-tenure employment restriction, requiring prior approval and disclosure of employment with Data Fiduciaries involved in proceedings initiated by or before them.