Rule 20 - Functioning of Board as digital office

Rule 20 establishes the Data Protection Board of India as a digital-first regulatory and adjudicatory institution. Proceedings may be initiated, managed, heard and concluded through electronic systems without requiring the physical presence of the parties, witnesses, representatives or other participants. At the same time, the Rule expressly preserves the Board’s statutory authority to summon a person, compel attendance and examine that person on oath where physical or direct participation is necessary.

Rule 20 came into force on 13 November 2025, together with the institutional provisions establishing and enabling the Board.

The Rule should be read with the DPDPA’s definition of a “digital office,” which contemplates an online mechanism through which proceedings, from receipt of an intimation, complaint, reference or direction to final disposal, are conducted in digital mode. It must also be read with the Board’s inquiry powers and Rule 19, which governs Board meetings, decision-making, authentication and inquiry timelines.

Rule 20 is therefore not limited to permitting video-conference hearings. It contemplates an end-to-end digital system covering the complete proceeding, including filing, registration, communication, submission of evidence, hearings, procedural directions, orders and case closure.

1.1 Digital-first functioning rather than absence of adjudicatory power

The Board’s status as a digital office affects the mode in which it functions, not the legal force of its proceedings. An electronic complaint, digitally authenticated direction, virtual hearing or electronically issued order is not inherently less formal than its paper or physical equivalent.

A proceeding conducted digitally can still involve:

• contested allegations;

• technical evidence;

• examination of witnesses;

• interim directions;

• findings of non-compliance;

• remedial measures;

• and monetary penalties.

The digital format does not reduce the obligation to observe procedural fairness. A person against whom proceedings are initiated must still receive adequate notice of the case, a meaningful opportunity to respond, access to the material necessary to present a defence and a reasoned determination by the Board.

The Rule should accordingly be understood as an enabling provision. It allows the Board to use technology to make proceedings more accessible and efficient, while preserving the procedural safeguards and coercive powers established by the Act.

1.2 End-to-end digital proceedings

The Board’s digital-office model may extend across the full lifecycle of a matter. An appropriate system could permit:

• electronic submission of a complaint, breach intimation, reference or other authorised filing;

• automated acknowledgement and generation of a case reference;

• online scrutiny of filings;

• secure service of notices;

• electronic filing of replies, evidence and written submissions;

• digital case management;

• virtual appearances;

• electronic examination of witnesses;

• procedural communication through a secure portal;

• recording of hearing dates and deadlines;

• digital authentication and delivery of orders;

• and preservation of the complete procedural record.

This model is particularly suited to a data-protection regulator. Complaints may arise throughout India, regulated entities may operate in several locations, and evidence will frequently consist of electronic records, system logs, consent records, access histories, security reports, emails, database extracts and Processor documentation. Requiring routine physical filing and attendance could increase expense and delay without improving the quality of adjudication.

Digital proceedings may also allow the Board to handle cases involving large numbers of affected Data Principals or multiple Data Fiduciaries and Processors more efficiently. However, efficiency cannot be achieved by reducing a proceeding to an automated exchange of forms where oral explanation, technical clarification or examination of evidence is genuinely required.

1.3 Techno-legal measures

Rule 20 permits the Board to adopt “techno-legal measures.” This expression should be understood as measures combining legal procedure with technological implementation.

The Board’s systems must do more than provide communication software. They must translate procedural requirements into secure and legally reliable digital workflows.

The relevant measures may include:

• reliable identification of parties and authorised representatives;

• secure user accounts;

• electronic signatures or other lawful authentication methods;

• time-stamped filing and service;

• controlled access to case records;

• preservation of document integrity;

• audit trails;

• secure virtual-hearing facilities;

• recording of procedural events;

• confidentiality controls;

• evidence-management tools;

• and digitally verifiable orders.

Technology should serve the legal process rather than determine its outcome without proper authority. A case-management system may calculate deadlines, issue notices, organise documents and flag procedural defaults. It should not independently determine whether a breach occurred or whether a penalty should be imposed unless the Act and Rules specifically authorise that form of decision-making.

The Board also remains responsible for the accuracy and reliability of its systems. If a portal incorrectly records a filing as late, fails to upload evidence or sends a notice to the wrong account, the affected person should have an effective route to raise the error. A technical failure should not automatically deprive a person of the opportunity to be heard.

1.4 Preservation of summons and examination powers

The expression “without prejudice to” makes clear that digital functioning does not limit the Board’s power to compel attendance or examine a person on oath.

The Board may generally conduct a matter without physical attendance but require direct participation where necessary to:

• verify evidence;

• examine a witness;

• assess conflicting testimony;

• obtain information unavailable through written submissions;

• require production of records;

• or address deliberate non-cooperation.

The power to summon should not be treated as inconsistent with the digital-office model. A summons may require appearance through a secure virtual process where that is legally and practically sufficient. If virtual participation is inadequate, the Board’s preserved statutory authority allows it to require attendance in another appropriate manner.

The Rule does not state that every person is entitled to insist on physical appearance, nor does it state that the Board may never require it. The Board retains procedural discretion, subject to the Act, fairness, necessity and the circumstances of the proceeding.

A person cannot avoid a valid summons simply by relying on the Board’s status as a digital office. Conversely, the Board should not require physical presence as a routine formality where virtual participation would adequately serve the proceeding.

1.5 Procedural fairness in a digital environment

The digital-office model must remain consistent with natural justice. A digital process should provide a real, not merely theoretical, opportunity to participate.

A person should be able to:

• understand the allegation or issue;

• access the relevant notice and case material;

• submit a response;

• provide supporting evidence;

• identify and challenge material relied upon;

• attend a hearing where one is required;

• receive procedural communications;

• and obtain the Board’s final order.

The Board should account for situations in which a participant faces genuine technological barriers. Connectivity problems, disability, lack of access to suitable equipment, large technical records or language difficulties may affect meaningful participation. Digital convenience for the institution should not become procedural exclusion for a party.

Appropriate flexibility may involve permitting:

• assisted filing;

• alternative document-submission arrangements;

• accessible hearing technology;

• adjournment where a material technical failure occurs;

• captioning or other accessibility support;

• and hybrid or physical participation in exceptional cases.

This does not require the Board to abandon digital functioning whenever a party prefers traditional procedure. It requires the Board to ensure that the chosen method remains fair and effective.

1.6 Service of notices and communications

A digital proceeding depends heavily on reliable electronic service.

The Board should be able to establish:

• the address or account to which the communication was sent;

• the date and time of transmission;

• whether the document was made available;

• whether delivery failed;

• and whether further steps were necessary.

Merely uploading a notice to an account that the affected person does not know exists may not provide meaningful notice. Similarly, an automated message filtered as spam should not always be treated as conclusive evidence that the person knowingly received and ignored the proceeding.

The Board may use registered digital accounts, verified email addresses, portal notifications, mobile alerts or other approved methods. The procedure should contain safeguards for:

• incorrect contact information;

• bounced communications;

• compromised accounts;

• changes in authorised representatives;

• and urgent directions requiring prompt attention.

The legal reliability of digital service will be central because failure to respond may have serious procedural consequences.

1.7 Electronic evidence and integrity of the record

Proceedings before the Board are likely to rely substantially on electronic evidence. This may include:

• consent logs;

• privacy notices;

• system configurations;

• database records;

• access logs;

• breach timelines;

• audit reports;

• Processor communications;

• screenshots;

• emails;

• security alerts;

• forensic reports;

• and records of correction or erasure.

Digital submission does not eliminate questions of authenticity, completeness or reliability. The Board must be able to determine:

• where the record originated;

• whether it has been altered;

• whether relevant context is missing;

• whether timestamps are reliable;

• whether the record relates to the correct system or Data Principal;

• and whether the person producing it has authority and knowledge sufficient to explain it.

The digital-office system should preserve the integrity of the evidence submitted. Controls should prevent unauthorised alteration, substitution or deletion after filing and should maintain a traceable history of additions, corrections and access.

Where a party submits a large volume of technical information, the Board may require structured presentation rather than unmanageable data dumps. At the same time, procedural efficiency should not be used to exclude material evidence necessary for deciding the matter.

1.8 Confidentiality and security

The Board’s systems may contain highly consequential information, including:

• details of personal data breaches;

• identity documents;

• children’s data;

• financial and health information;

• commercially sensitive system architecture;

• cybersecurity vulnerabilities;

• audit reports;

• confidential contracts;

• investigative records;

• and information concerning large numbers of Data Principals.

The digital-office infrastructure must therefore maintain strong security and confidentiality.

Different participants should receive access only to the records they are entitled to see. Public availability of a final order does not necessarily justify public access to every filing, witness statement or confidential technical annexure.

The Board should be able to protect:

• third-party personal data;

• legally privileged material;

• confidential business information;

• security-sensitive evidence;

• and information whose publication could facilitate further attacks.

At the same time, confidentiality should not prevent a party from seeing material relied upon against it unless a valid legal procedure permits restriction and provides an appropriate alternative.

The Board’s digital character also makes continuity and recoverability important. Proceedings should not be lost or materially impaired because of system outage, corruption, ransomware, accidental deletion or service-provider failure. Secure backups, access controls, logging, incident response and preservation of authentic records are therefore essential to the credibility of the adjudicatory process.

1.9 Relationship with Rule 19

Rule 19 and Rule 20 should operate together.

Rule 19 governs:

• convening Board meetings;

• quorum;

• voting;

• conflicts of interest;

• emergency action;

• decisions by circulation;

• authentication;

• and inquiry timelines.

Rule 20 allows those institutional and adjudicatory functions to be supported by digital systems.

A Board meeting under Rule 19 may therefore take place virtually, provided quorum, participation and voting are reliably established. A decision by circulation may be managed through a secure electronic platform. An order may be digitally authenticated by an authorised person. An inquiry may be conducted through electronic filings and virtual hearings while remaining subject to Rule 19’s six-month completion period and reasoned-extension mechanism.

Digital procedure does not alter the underlying allocation of power. A platform administrator cannot decide a matter merely because that person manages the case system. The decision must still be made by the Chairperson, Members or Board through the procedure authorised by the Act and Rules.

1.10 Relationship with appeals

The Board’s digital records will also be important where an order is appealed to the Appellate Tribunal.

A reliable electronic case file should permit transmission of:

• the original complaint, intimation, reference or direction;

• notices;

• replies;

• evidence;

• hearing records;

• interim directions;

• procedural applications;

• and the final authenticated order.

The integrity and completeness of this record may determine whether the appellate body can properly examine the Board’s reasoning and procedure.

The digital-office model should therefore preserve records in a form suitable not only for immediate Board use but also for appellate review and enforcement.

1.11 Institutional significance

Rule 20 reflects a deliberate choice to establish the Data Protection Board as a digitally native institution rather than converting an existing paper-based tribunal into an electronic one.

This approach can offer significant institutional benefits:

• nationwide accessibility;

• reduced travel;

• quicker filing and service;

• easier management of electronic evidence;

• improved tracking of deadlines;

• standardised case records;

• and more efficient interaction with Data Fiduciaries and Data Principals.

Those benefits depend on the quality of implementation. A poorly designed digital portal can create new barriers through inaccessible interfaces, rigid filing formats, failed uploads, weak authentication, limited language support and inadequate technical assistance.

The legal success of the model will therefore depend not merely on whether proceedings are technically online, but on whether the system is:

• secure;

• accessible;

• auditable;

• reliable;

• procedurally fair;

• and capable of handling technically complex disputes.

1.12 Concluding interpretation

Rule 20 makes digital procedure the Board’s ordinary operating model while preserving the legal authority necessary for effective adjudication. It allows the complete proceeding to be conducted without physical presence but does not remove the Board’s power to compel attendance, examine persons on oath or require direct participation where necessary.

The provision should not be interpreted either as a requirement that every procedural act must occur exclusively online in all circumstances or as a broad discretion to dispense with hearings and procedural safeguards. It establishes a digital-first framework, not a fairness-light framework.

The Board must use techno-legal measures so that electronic filing, virtual participation, digital evidence, secure communication and authenticated orders operate as legally credible components of a statutory proceeding. Its digital systems must support, rather than weaken, proper notice, meaningful participation, impartial decision-making, confidentiality, evidentiary integrity and appellate review.

Key point

Rule 20 establishes the Data Protection Board as an end-to-end digital institution, but digital convenience does not displace adjudicatory fairness. The Board may conduct proceedings without physical presence while retaining the power to compel attendance and examine persons on oath. Its techno-legal systems must therefore combine accessibility and efficiency with secure evidence handling, reliable service, procedural fairness and legally authenticated decision-making.