Section 31 - Alternate dispute resolution

Section 31 allows the Data Protection Board of India to refer a suitable complaint to mediation. Its purpose is to help the parties resolve practical, individual disputes without requiring the Board to adjudicate every complaint through a contested proceeding.

Commencement: Section 31 is scheduled to come into force on13 May 2027. As of 17 August 2026, it has been enacted but is not yet operational.

1. “If the Board is of the opinion”

The decision to refer a complaint to mediation belongs to the Board.

Neither party can insist on mediation as an automatic right. The complainant cannot compel the Data Fiduciary to mediate merely by requesting it, and the Data Fiduciary cannot use an offer of mediation to prevent the Board from examining a serious complaint.

The Board must first consider whether mediation is suitable. Relevant considerations may include:

• the nature of the dispute;

• the remedy sought;

• whether the problem can be corrected;

• whether the parties have an ongoing relationship;

• whether the complaint affects only the complainant or a large class of people;

• whether urgent regulatory action is required;

• whether the complaint reveals repeated or systemic non-compliance; and

• whether mediation could resolve the dispute without harming third parties.

The Board need not decide the legal merits before making a referral. It needs only to conclude that the complaint may be capable of settlement.

Illustration

A customer withdraws consent to marketing, but promotional messages continue because one marketing processor did not update its suppression list. The customer seeks:

• cessation of messages;

• removal from all marketing databases;

• written confirmation of deletion; and

• an explanation.

The Board may reasonably consider this complaint suitable for mediation because the dispute can potentially be resolved through specific corrective commitments.

2. “Any complaint”

The expression is broad enough to include different kinds of complaints, but it does not mean that every complaint should be mediated.

2.1 Complaints that may be suitable

Mediation may be useful for disputes involving:

• failure to correct inaccurate personal data;

• continued marketing after consent withdrawal;

• delayed erasure;

• retention of an unsuccessful applicant’s records;

• incorrect employee information;

• disputed account closure;

• access to consent records;

• a grievance that was not properly investigated.

3. “May be resolved by mediation”

Mediation is suited to disputes in which a practical solution can address the Data Principal’s concern.

Possible outcomes include:

• correcting inaccurate information;

• deleting data from identified systems;

• stopping marketing;

• implementing consent withdrawal;

• restoring account access;

• reconsidering an adverse decision;

The settlement should deal with the real source of the complaint. A payment alone may be inadequate where incorrect information remains in the Data Fiduciary’s systems or continues to affect the individual.

4. “It may direct the parties”

The Board may direct the parties to attempt mediation. This is stronger than merely suggesting it.

However, the Board cannot force the parties to reach or accept a settlement. Mediation remains a consensual process as to the final outcome.

A party may:

• reject a proposed payment;

• refuse to admit liability;

• decline an impractical deletion request;

• insist on legally required retention;

• reject an overly broad confidentiality clause; or

• end mediation if no acceptable resolution is possible.

Failure to settle does not by itself establish that either party violated the DPDPA.

5. “The parties concerned”

The parties will ordinarily be:

• the Data Principal who made the complaint; and

• the Data Fiduciary against whom the complaint was filed.

Depending on the facts, other relevant participants may include:

• another Data Fiduciary involved in joint processing;

• a Consent Manager;

• a parent or lawful guardian;

• another entity already made a party to the complaint; or

• a Data Processor whose technical participation is necessary to implement a settlement.

A Data Processor’s participation does not replace the Data Fiduciary’s accountability.

6. Selection of the mediator

Section 31 provides two possible routes.

6.1 Mutually agreed mediator

The parties may jointly select:

• an individual mediator;

• a mediation institution;

• a person with privacy expertise; or

• a specialist familiar with the relevant technical or commercial issue.

The mediator should be:

• independent;

• impartial;

• free from conflicts;

• appropriately trained;

• capable of understanding the DPDPA; and

• competent to handle technical evidence where relevant.

One party cannot unilaterally appoint its preferred mediator under this route.

6.2 Mediator under another Indian law

The mediation may also proceed under a framework provided by another law in force in India.

The Mediation Act, 2023 contains provisions concerning mediators, proceedings, confidentiality, settlement agreements, enforcement, challenge and online mediation. However, only specified provisions of that Act were initially commenced on 9 October 2023. The operative status of the relevant provisions must therefore be verified when an actual Section 31 mediation takes place.

7. Confidentiality

Section 31 itself does not establish a detailed confidentiality framework.

The parties should therefore clarify:

• whether mediation discussions are confidential;

• whether settlement offers can be used before the Board;

• whether the mediator can disclose information;

• whether mediator notes will be destroyed;

• whether admissions are protected;

• whether the settlement itself is confidential; and

• what information must be reported to the Board.

Confidentiality cannot override mandatory legal obligations. A settlement cannot prevent disclosure required to:

• the Board;

• affected Data Principals;

• CERT-In;

• a sectoral regulator;

• a court; or

• another competent authority.

Nor should confidentiality be used to conceal an ongoing breach or continuing unlawful processing.

8. Settlement terms

A mediated settlement should be written, specific and capable of implementation.

It should identify:

• the disputed processing;

• records or systems affected;

• action to be taken;

• responsible party;

• deadline;

• processors and recipients involved;

• evidence of completion;

• legal-retention exceptions;

• continued access restrictions;

• confidentiality terms;

• consequences of non-performance; and

• the procedure for informing the Board.

8.1 Weak term

“The Data Fiduciary will take appropriate measures to address the complaint.”

8.2 Better term

“Within fifteen days, the Data Fiduciary shall correct the complainant’s employment status in the HRMS, payroll and insurance systems, direct the payroll provider and insurer to correct their corresponding records, and provide written confirmation identifying the date on which each correction was completed.”

Specific terms reduce future disagreement.

9. Limits on settlement

The parties cannot use mediation to contract out of mandatory statutory duties.

A settlement should not:

• authorise unlawful future processing;

• waive all future Data Principal rights;

• excuse mandatory breach notification;

• eliminate legally required security safeguards;

• permit indefinite retention without purpose or law;

• bind affected persons who were not parties;

• legitimise processing of third-party data; or

• prevent the Board from exercising statutory powers.

A Data Principal may agree to resolve her individual complaint. She cannot ordinarily surrender the independent rights of thousands of other affected individuals.

10. Systemic violations

A settlement may resolve the complainant’s individual dispute while leaving a wider compliance problem unresolved.

10.1 Case study: Inactive-user data

One former user complains that a platform retained her personal data long after account closure. During mediation, the platform deletes her records.

The Board discovers that the same system retains the records of five million inactive users.

The individual complaint may be resolved, but the Board may still need to consider:

• wider investigation;

• corrective measures;

• protection of other users;

• a voluntary undertaking;

• adjudication; or

• penalties.

Section 31 does not expressly state that settlement automatically ends every regulatory issue arising from the underlying conduct.

11. Successful and unsuccessful mediation

11.1 Successful mediation

Where the parties agree, the settlement should be:

• reduced to writing;

• properly authenticated;

• reported to the Board;

• precise about implementation;

• clear about the complaint’s procedural status; and

• consistent with mandatory legal obligations.

The Board should determine whether:

• the complaint is fully resolved;

• part of the complaint remains;

• compliance monitoring is required;

• a voluntary undertaking is appropriate; or

• a systemic issue should continue separately.

11.2 Unsuccessful mediation

If the parties cannot agree:

• the mediator should ordinarily report non-settlement without disclosing confidential negotiations;

• the complaint should return to the Board;

• neither party should be prejudiced merely because settlement failed; and

• the Board should continue according to the DPDPA’s procedural framework.

The Board should decide the matter on lawful evidence, not on settlement proposals or concessions made solely during mediation.

11.3 Concluding interpretation

Section 31 gives the Board a flexible means of resolving complaints through practical, negotiated remedies. It is best suited to individual disputes involving correction, deletion, consent withdrawal, access, account management, limited disclosure or another problem that can be remedied through specific commitments.

Its limits are equally important:

• the Board decides suitability;

• the parties can be directed to attempt mediation but not to settle;

• the mediator facilitates rather than adjudicates;

• mandatory statutory duties cannot be waived;

• non-parties cannot lose their rights;

• systemic violations may continue before the Board; and

• an unsuccessful mediation returns the complaint to the ordinary statutory process.

The central principle is:

Mediation may resolve the private dispute, but it cannot be used to privatise or remove the public obligations imposed by the DPDPA.