Section 27 — DPDP Act, 2023
(1) The Board shall have the power— (a) to call for any information, document, record or data from a Data Fiduciary or any intermediary; (b) to conduct a preliminary inquiry; (c) to direct a Data Fiduciary or any intermediary to take such measures as it considers necessary; (d) to impose penalties as specified in the Schedule. (2) The Board shall exercise its powers and discharge its functions in accordance with the provisions of this Act.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 27 gives the Board four core powers: information demands, inquiry, remedial directions, and penalties. The information demand power (Section 27(1)(a)) is significant — the Board can compel any Data Fiduciary to produce documents, data, and records as part of an investigation. There is no privilege against this demand. The penalty power extends to the Schedule, where the maximum fine for inadequate security safeguards is Rs 250 crore per finding.
If the Board initiates an inquiry following a Data Principal's complaint, it can demand consent records, processor contracts, breach notification logs, and any other documentation relevant to the inquiry. Failure to respond to an information demand is itself a violation that can attract separate penalty.