Rule 22 - Appeal to Appellate Tribunal

Rule 22 operationalises the appellate remedy created by Section 29 of the Digital Personal Data Protection Act, 2023. It permits a person aggrieved by an order or direction of the Data Protection Board of India to challenge that order before the Appellate Tribunal through a digitally administered appellate process.

The Appellate Tribunal for this purpose is the Telecom Disputes Settlement and Appellate Tribunal, commonly known as TDSAT, established under the Telecom Regulatory Authority of India Act, 1997. The DPDPA uses an existing specialised tribunal rather than creating a separate appellate institution exclusively for data-protection matters.

Rule 22 is scheduled to come into force on 13 May 2027. Although the provisions establishing the Data Protection Board and enabling its institutional functioning commenced on 13 November 2025, Rule 22 belongs to the later phase of implementation.

1.1 Appellate remedy against Board decisions

The right of appeal originates in Section 29. Rule 22 does not create the substantive appellate right but prescribes important procedural details governing its exercise.

A person may appeal where she is aggrieved by an order or direction made by the Board under the DPDPA. The expression is broad enough to include a Data Fiduciary, Significant Data Fiduciary, Consent Manager, Data Processor in an appropriate case, intermediary, Data Principal or another person whose legal rights or interests are materially affected by the Board’s decision.

The appellant must nevertheless show a genuine grievance arising from an appealable order or direction. A person ordinarily cannot invoke the appellate jurisdiction merely because she disagrees with a general statement made by the Board, is dissatisfied with an administrative communication having no operative legal effect, or has only an abstract interest in the issue.

The appeal is directed against the Board’s decision, not against the underlying conduct alone. A Data Principal dissatisfied with a Data Fiduciary’s processing must first follow the procedures contemplated by the DPDPA, including the applicable grievance and Board mechanisms. Rule 22 does not permit the person to bypass the Board and approach TDSAT directly as the forum of first instance.

Section 29 requires the appeal to be filed within sixty days from receipt of the Board’s order or direction. The starting point is receipt, not necessarily the date printed on the order. The Appellate Tribunal may entertain a delayed appeal if it is satisfied that sufficient cause prevented filing within the sixty-day period. The power to condone delay is discretionary and requires the appellant to explain the delay adequately.

1.2 Digital filing

Rule 22 requires an appeal to be filed in digital form in the manner decided by the Appellate Tribunal. This complements Section 29(10), which requires TDSAT, as far as practicable, to function as a digital office for DPDPA appeals, with the receipt, hearing and pronouncement of decisions being digital by design.

The precise filing procedure will therefore depend on the system and procedural requirements adopted by TDSAT. These may regulate matters such as:

• creation of an authorised user account;

• electronic format of the memorandum of appeal;

• digital authentication;

• filing of the impugned order;

• supporting documents;

• authorisation of representatives;

• proof of service;

• fee payment;

• defect correction; and

• issuance of an electronic filing reference.

A digital appeal should be treated as formally instituted only when the requirements prescribed by the Tribunal are met. Merely emailing documents to an unofficial address or uploading an incomplete file may not constitute valid filing.

At the same time, digital procedure should not operate as an unreasonable barrier to appellate review. The Tribunal’s filing system should accommodate accessibility requirements, large evidentiary records, authorised representatives and genuine technical failures. A procedural defect should ordinarily be distinguished from a complete failure to appeal, particularly where the appellant attempted to file within the limitation period and can demonstrate that the digital system prevented completion.

1.3 Appellate fee

An appeal must be accompanied by a fee equal to the fee applicable to an appeal under the Telecom Regulatory Authority of India Act, 1997. Rule 22 therefore does not state a fixed rupee amount within the DPDP Rules themselves. The applicable amount follows the fee governing appeals under the TRAI framework and may consequently be affected by valid changes to that framework. TDSAT is the appellate body established under the TRAI Act for adjudicating disputes and disposing of appeals.

The fee must be paid digitally through:

• the Unified Payments Interface; or

• another payment system authorised by the Reserve Bank of India.

This aligns payment with the digital filing model and permits the use of other RBI-authorised systems without requiring amendment of Rule 22 each time digital-payment infrastructure evolves.

The Chairperson of the Appellate Tribunal may reduce or waive the fee. This is an important access-to-justice safeguard. A person should not be denied appellate review merely because payment of the ordinary fee would create disproportionate hardship.

The discretion is given to the Chairperson and should be exercised judicially. Relevant considerations may include the appellant’s financial position, nature of the grievance, public-interest dimension, circumstances of the case and whether the request is bona fide. The Rule does not make waiver automatic for any category of appellant, nor does it confine waiver to a Data Principal. A person seeking reduction or waiver should use the procedure prescribed by the Tribunal and provide the information reasonably necessary to support the request.

1.4 Nature and scope of appellate review

Section 29 gives the Appellate Tribunal authority, after hearing the parties, to:

• confirm the Board’s order;

• modify it; or

• set it aside.

The Tribunal’s jurisdiction is therefore not confined to correcting clerical errors or reviewing only the amount of a monetary penalty. It may examine whether the Board:

• correctly interpreted the Act and Rules;

• acted within its jurisdiction;

• followed the required procedure;

• observed the principles of natural justice;

• relied on relevant evidence;

• reached findings supported by the record;

• issued a proportionate direction;

• or correctly applied the penalty framework.

The Tribunal may also examine mixed questions involving law and technology, such as whether particular safeguards were reasonable, whether a system created an unauthorised processing purpose, whether a personal data breach occurred, whether Processor controls were adequate or whether the Board mischaracterised a technical fact.

The appeal should not ordinarily become an entirely unrelated proceeding disconnected from the Board’s order. Its focus remains the legality and correctness of the order or direction under challenge. The Tribunal’s procedural flexibility may allow additional material where necessary, but an appellant should not withhold its case before the Board and then attempt to reconstruct the dispute only at the appellate stage without justification.

1.5 Natural justice and procedural flexibility

Rule 22 states that the Appellate Tribunal is not bound by the procedure laid down in the Code of Civil Procedure, 1908. This allows TDSAT to regulate DPDPA appeals without applying every technical requirement governing an ordinary civil suit.

The exemption from the Code does not create unrestricted procedural discretion. The Tribunal must be guided by the principles of natural justice and remain subject to the DPDPA. Its procedure must therefore preserve, according to the circumstances:

• adequate notice;

• disclosure of the case to be answered;

• meaningful opportunity to present submissions and evidence;

• impartial adjudication;

• consideration of relevant material;

• fair treatment of both parties; and

• a reasoned decision.

Section 29 independently requires the parties to be given an opportunity of being heard before the Tribunal confirms, modifies or sets aside the Board’s order.

The Tribunal may adopt procedures proportionate to the dispute. A narrow legal issue may be determined primarily through written submissions. A technically complex appeal involving disputed evidence, expert reports or contested system records may require oral hearing, clarification or examination of witnesses. Procedural flexibility should improve the quality and efficiency of adjudication without weakening fairness.

1.6 Digital-office functioning

Rule 22 reinforces the digital design prescribed by Section 29. The Tribunal may use techno-legal measures to conduct proceedings without requiring the physical presence of any individual.

This may include digital systems for:

• filing and scrutiny;

• electronic service;

• case management;

• submission of written arguments;

• virtual hearings;

• presentation of technical evidence;

• examination of witnesses;

• payment of fees;

• issuance of interim directions;

• authentication of decisions; and

• delivery of final orders.

The digital model is particularly appropriate for appeals under the DPDPA because the evidence is likely to be primarily electronic, including system logs, consent records, audit reports, security evidence, data-flow records, processing contracts and electronic communications.

Digital procedure does not reduce the legal status of the proceeding. An electronically filed appeal, virtual hearing or digitally pronounced order remains part of a formal statutory adjudication.

Nor does digital functioning eliminate procedural fairness. The Tribunal’s systems must permit parties to access the record, understand deadlines, submit evidence securely and participate meaningfully. Reasonable accommodation may be needed where a party faces accessibility barriers, technical limitations or a material system failure.

1.7 Summons and examination on oath

The digital-office model operates without prejudice to the Tribunal’s power to summon and enforce the attendance of any person and examine that person on oath.

This preserves the Tribunal’s ability to obtain reliable testimony and evidence where written submissions or ordinary virtual participation are inadequate. A party or witness cannot avoid a valid summons merely because the Tribunal generally conducts proceedings online.

The Tribunal may use digital means to exercise these powers where legally and practically appropriate. Examination on oath can potentially occur through a secure virtual hearing if identity, participation, confidentiality and integrity are adequately established. Where those safeguards cannot be maintained, the Tribunal may require another mode of attendance.

The preserved summons power prevents the digital model from becoming dependent entirely on voluntary cooperation. It allows the Tribunal to deal with disputes involving contested evidence, withheld records or non-cooperative parties while continuing to operate predominantly through electronic procedures.

1.8 Relationship with TDSAT’s existing statutory powers

Rule 22 must be read with Sections 14A and 16 of the TRAI Act, which Section 29 expressly preserves for DPDPA appeals. TDSAT already has an established statutory framework governing its jurisdiction, procedure and powers. The TRAI Act provides that the Tribunal is not bound by the Code of Civil Procedure but is guided by natural justice and possesses specified powers corresponding to those of a civil court for evidentiary and procedural purposes.

Rule 22 adapts that existing framework to the DPDPA’s digital design. The Tribunal does not become part of the Data Protection Board. It remains the separate appellate institution reviewing the Board’s decisions.

This separation is essential. The Board is the first-instance regulatory and adjudicatory authority under the DPDPA. TDSAT provides external review. The Tribunal may examine the Board’s interpretation, findings, procedure and directions without being institutionally subordinate to it.

1.9 Disposal of appeals and further review

Section 29 requires appeals to be dealt with as expeditiously as possible and states that an endeavour should be made to dispose of them within six months from presentation. If an appeal cannot be disposed of within that period, the Tribunal must record its reasons in writing.

The six-month period is an expedition standard rather than an automatic invalidation rule. An order passed later does not become invalid solely because the appeal took more than six months, particularly where reasons for delay have been recorded. Nevertheless, the requirement prevents indefinite appellate proceedings without institutional explanation.

A further appeal from an order of the Appellate Tribunal is governed through Section 18 of the TRAI Act, as incorporated by Section 29(9) of the DPDPA. The TRAI Act provides the route for appeal to the Supreme Court within its statutory conditions.

The appellate structure is consequently:

1. the Data Protection Board makes an order or direction;

2. an aggrieved person may appeal to TDSAT under Section 29 and Rule 22;

3. TDSAT may confirm, modify or set aside the decision; and

4. a further appeal may lie to the Supreme Court under the incorporated TRAI Act framework.

Rule 22 itself does not create an automatic suspension of the Board’s order merely because an appeal has been filed. Unless the Act, the impugned order or an interim direction of the Tribunal provides otherwise, an appellant should not assume that filing alone stays the Board’s decision. Where interim protection is necessary, it must be sought through the applicable Tribunal procedure.

1.10 Overall interpretation

Rule 22 establishes a specialised and digitally administered appellate remedy against orders and directions of the Data Protection Board. It works with Section 29 to provide an aggrieved person sixty days from receipt of the decision to approach TDSAT, subject to the Tribunal’s power to condone delay for sufficient cause.

The Rule makes digital filing and digital payment integral to the appellate process, while allowing the Tribunal’s Chairperson to reduce or waive the fee. It permits TDSAT to regulate its own procedure outside the technical framework of the Code of Civil Procedure, but subjects that flexibility to natural justice, the DPDPA and the requirement of a meaningful hearing.

The Tribunal’s digital-office status is intended to make appellate review more accessible, efficient and compatible with electronic evidence. It does not weaken the Tribunal’s authority to compel attendance, examine persons on oath, scrutinise technical records or provide effective appellate correction.

Key point

Rule 22 creates a digital but fully adjudicatory appellate process. An aggrieved person may challenge a Board order before TDSAT through the prescribed electronic procedure, and the Tribunal may confirm, modify or set aside that decision after observing natural justice. Digital filing, virtual hearings and electronic orders change the mode of appellate justice, not its seriousness, legal authority or obligation to provide fair and reasoned review.