Section 35 protects the Central Government, the Data Protection Board of India, and the Board’s Chairperson, Members, officers and employees from suits, prosecutions and other legal proceedings for actions taken, or genuinely intended to be taken, in good faith while performing functions under the DPDPA or its Rules.

The provision enables public authorities and regulatory officials to perform their statutory responsibilities without facing personal litigation merely because an affected person disagrees with their decision or because an honestly taken action is later found to contain a factual, technical or legal error. For example, a Board officer who issues a notice, requests information or takes a procedural step based on material reasonably available at the time may receive protection even if the assessment is subsequently corrected.

The protection is not absolute. It applies only where the conduct:

  • is genuinely connected with administration of the DPDPA or its Rules;

  • is undertaken honestly for a statutory purpose; and

  • is not motivated by malice, corruption, retaliation, personal benefit or another improper purpose.

Section 35 does not automatically protect private consultants, auditors, technology providers, forensic investigators or other contractors assisting the Government or Board. The statutory protection is limited to the persons expressly identified in the provision.

The immunity also does not make an incorrect or unlawful order valid. A Board decision may still be challenged through the applicable appellate or judicial process. Section 35 protects officials from personal proceedings for good-faith conduct, but it does not eliminate review of the legality, correctness or constitutionality of the underlying action.

Accordingly, an honest regulatory mistake may be protected, while deliberate suppression of evidence, misuse of confidential information, undisclosed conflicts of interest, retaliation against a complainant or action taken for private gain would fall outside the provision’s protective purpose.

Section 35 came into force on 13 November 2025 and is already operational.