Guide
Board reporting on DPDP
Directors need a clear view of DPDP readiness before 13 May 2027 and a clear escalation path after it. This guide sets out what to report and how.
Short answer
Report DPDP to your company board every quarter: readiness against each duty, open requests and grievances, breaches, processor coverage and SDF exposure, all measured from your own records. Do not confuse the company board with the Data Protection Board of India, the regulator established under s.18, which has no members yet. Core obligations begin on 13 May 2027, and an SDF's Data Protection Officer must be responsible to the Board of Directors or a similar governing body (s.10(2)(a)).
Two boards, two audiences
| Aspect | Your company board | Data Protection Board of India |
|---|---|---|
| What it is | Your Board of Directors or similar governing body | The regulator established under s.18 |
| Status | In place | No members appointed yet |
| What it receives from you | Quarterly DPDP reports and incident escalations | Breach intimations and detailed reports (Rule 7); for SDFs, significant observations from the yearly DPIA and audit (Rule 13) |
| Link to DPDP | An SDF's DPO is responsible to it (s.10(2)(a)) | Decides penalties after an inquiry (s.33) |
Board papers often say "the Board" for both. Write "the Data Protection Board" for the regulator and "the board" or "directors" for your own, so the minutes stay clear.
What to report each quarter
| Area | Measure from your own records | Source |
|---|---|---|
| Readiness | Controls in place, partial or not started, and the change since last quarter | Your DPDP checklist |
| Requests | Requests received and closed, and the oldest open request against your internal target | Rule 14 |
| Grievances | Grievances received, and any close to your published period | s.13, Rule 14 |
| Breaches | Incidents, time from awareness to intimation, detailed reports filed | Rule 7 |
| Processors | Share of processors with signed contracts and current assessments | s.8(2), Rule 6 |
| Data map | Systems mapped against systems known | s.8(1) |
| Children's data | Products serving under-18s, and parental consent status | s.9 |
| SDF exposure | Changes in the factor review, and any notification | s.10 |
Use your own numbers and trends, and do not add industry benchmarks you cannot source. Keep the report to two pages: readiness, the measures with last quarter's figures alongside, open risks and decisions needed.
Questions directors should ask
- Who owns DPDP here, and do they have the budget and authority they need?
- Which duties are not yet in place, and when will they be?
- If a breach happened tonight, who would intimate the Data Principals and, once it has members, the Board?
- Which vendors hold the most personal data, and are they all under contract?
- Could we be notified as an SDF, and what would we need to put in place quickly?
Set up reporting and escalation
- 01Agree the owner
Name the executive or DPO who presents DPDP to the board.
- 02Fix the measures
Pick measures from the table above and define each one, so the numbers mean the same every quarter.
- 03Pull from records
Produce figures from systems of record, not from memory or estimates.
- 04Set escalation triggers
Agree which incidents go to the board at once and which wait for the quarterly report. Every Rule 7 breach should at least appear in the next report.
- 05Brief before the detailed report
For a serious breach, brief the board chair before the detailed report goes to the Data Protection Board, so directors are not surprised. The breach playbook sets the timeline.
- 06Minute decisions
Record what the board decides, such as budget or risk acceptance, in the minutes.
Board pack checklist
- One-page readiness summary with milestones to 13 May 2027
- Requests and grievances against targets
- Breach log and lessons learned
- Processor and transfer risks
- SDF exposure note
- Decisions needed from the board
- Status of the Data Protection Board and any new notifications
The Data Protection Board has no members yet, so no penalties have been imposed. Keep invented fines and enforcement examples out of board papers; if directors ask, explain the Schedule's maximums from the penalties page.
How TruePrivacy helps
The DPDP checklist in TruePrivacy marks controls compliant, partial or non-compliant and works out a posture score from live records. Use it as the readiness view in your board pack; it is not a certification.
Rights requests and the grievance desk track deadlines, breach management turns post-incident review actions into risk register entries, and the audit trail exports as CSV. Related tools: the readiness quiz and the penalty explainer.
Is the Board in the DPDP Act our board of directors?
No. The Data Protection Board of India is the regulator established under s.18. Your board of directors is your own governing body, to which an SDF's DPO is responsible (s.10(2)(a)).
How often should our board hear about DPDP?
Quarterly is a sensible rhythm, before and after 13 May 2027, with immediate escalation for serious breaches.
What should we tell directors about penalties?
The Schedule to the Act sets maximum amounts per type of breach, decided by the Board after an inquiry (s.33). No Board members have been appointed yet.
Should our DPDP measures use industry benchmarks?
Use your own records and trends. Avoid benchmarks you cannot source.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin