29.(1) Any person aggrieved by an order or direction made by the Board under this Act may prefer an appeal before the Appellate Tribunal.

(2) Every appeal under sub-section (1) shall be filed within a period of sixty days from the date of receipt of the order or direction appealed against and it shall be in such form and manner and shall be accompanied by such fee as may be prescribed.

(3) The Appellate Tribunal may entertain an appeal after the expiry of the period specified in sub-section (2), if it is satisfied that there was sufficient cause for not preferring the appeal within that period.

(4) On receipt of an appeal under sub-section (1), the Appellate Tribunal may, after giving the parties to the appeal, an opportunity of being heard, pass such orders thereon as it thinks fit, confirming, modifying or setting aside the order appealed against.

(5) The Appellate Tribunal shall send a copy of every order made by it to the Board and to the parties to the appeal.

(6) The appeal filed before the Appellate Tribunal under sub-section (1) shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date on which the appeal is presented to it.v

(7) Where any appeal under sub-section (6) could not be disposed of within the period of six months, the Appellate Tribunal shall record its reasons in writing for not disposing of the appeal within that period. (8) Without prejudice to the provisions of section 14A and section 16 of the Telecom Regulatory Authority of India Act, 1997, the Appellate Tribunal shall deal with an appeal under this section in accordance with such procedure as may be prescribed.

(9) Where an appeal is filed against the orders of the Appellate Tribunal under this Act, the provisions of section 18 of the Telecom Regulatory Authority of India Act, 1997 shall apply.

(10) In respect of appeals filed under the provisions of this Act, the Appellate Tribunal shall, as far as practicable, function as a digital office, with the receipt of appeal, hearing and pronouncement of decisions in respect of the same being digital by design.

Applicable DPDP Rule 2025

Rule 21: Appeal to Appellate Tribunal

Legal Interpretation of the

Section 29 of the Digital Personal Data Protection Act, 2023 (DPDPA)

Statutory Provision and Purpose

Provision: Section 29 of the Digital Personal Data Protection Act, 2023 states:

"Appeal to Appellate Tribunal."

While the section title is concise, its implications are profound in the context of the DPDPA's enforcement and redressal mechanisms. This provision establishes the framework for appeals against decisions or actions taken by the Data Protection Authority (DPA), ensuring that individuals and entities have access to an independent body for adjudication.

Purpose:
The primary objective of Section 29 is to provide a structured and accessible avenue for aggrieved parties to challenge decisions made by the DPA. By instituting an Appellate Tribunal, the Act ensures accountability, fairness, and the rule of law in the enforcement of data protection norms. This mechanism helps maintain public trust in the data protection regime by offering recourse against potential administrative errors or injustices.

Legal Interpretation

1. Establishment of the Appellate Tribunal

- Independent Body: Section 29 mandates the creation of an Appellate Tribunal specifically for handling appeals related to the DPDPA. This body operates independently of the DPA to ensure impartiality in adjudicating disputes.

- Composition: The Act may outline the composition of the Appellate Tribunal, typically comprising individuals with expertise in data protection, law, and related fields. This ensures that the Tribunal is well-equipped to handle complex data protection issues.

2. Scope of Appeal

Decisions Subject to Appeal: The Tribunal has jurisdiction over appeals against decisions, orders, or actions taken by the DPA. This includes, but is not limited to, penalties imposed, orders for data deletion, or any determinations affecting data processing activities.
Eligibility to Appeal: Both data principals (individuals whose data is being processed) and data fiduciaries (entities processing data) have the right to appeal decisions that adversely affect their rights or operations.

3. Grounds for Appeal

Error of Law or Fact: Appeals can be based on the assertion that the DPA erred in interpreting the law or in assessing the facts of the case.
Disproportionate Penalties: If penalties or orders issued by the DPA are deemed excessive or not commensurate with the offense, they can be challenged.
Procedural Irregularities: Any lapses in the procedural aspects of the DPA's decision-making process, such as lack of due process or failure to provide an opportunity for representation, can form grounds for appeal.

4. Procedure for Filing an Appeal

Time Frame: Section 29 may specify a time limit within which an appeal must be filed after the DPA's decision. Adhering to this timeframe is crucial for the Tribunal to accept and process the appeal.
Documentation: Detailed documentation supporting the grounds for appeal must be submitted. This includes evidence, legal arguments, and any relevant communications with the DPA.
Hearing Process: The Tribunal conducts hearings where both parties present their cases. This may involve examination of evidence, witness testimonies, and legal arguments.

5. Powers of the Appellate Tribunal

Review Authority: The Tribunal has the authority to uphold, modify, or overturn the DPA's decisions based on its findings.
Remedial Actions: Beyond altering decisions, the Tribunal can order remedial actions such as revising penalties, directing data deletion, or mandating compliance measures.
Binding Decisions: Decisions made by the Appellate Tribunal are binding on the DPA and the parties involved, ensuring that its rulings have enforceable outcomes.

6. Checks and Balances

Judicial Review: While the Appellate Tribunal serves as the primary appellate body, its decisions are subject to judicial review in higher courts to ensure they comply with constitutional and statutory provisions.
Transparency and Accountability: Proceedings of the Tribunal are typically transparent, and its decisions are published, promoting accountability and public confidence in the data protection framework.

7. Impact on DPDPA's Enforcement Mechanism

Enhanced Accountability: By providing an independent appellate mechanism, Section 29 strengthens the enforcement framework, ensuring that the DPA's actions are subject to scrutiny and review.
Protection of Rights: It safeguards the rights of both data principals and fiduciaries by offering a fair platform to contest decisions, thereby upholding the principles of justice and equity inherent in the DPDPA.
Encouraging Compliance: Knowing that decisions can be appealed and reviewed encourages the DPA to act judiciously and transparently, fostering a culture of compliance and mutual respect between data fiduciaries and the regulatory authority.

Illustrations

Illustration 1: Appeal Against Excessive Penalty Imposed on a Data Fiduciary

Scenario: A technology company, TechSoft, processes vast amounts of personal data. The DPA conducts an audit and concludes that TechSoft has violated data minimization principles, imposing a penalty of ₹50 lakhs.

Application of Section 29: TechSoft believes the penalty is disproportionate to the violation and contends that the DPA misinterpreted the data minimization requirements. Utilizing Section 29, TechSoft files an appeal to the Appellate Tribunal, presenting evidence that the violation was unintentional and rectified promptly. The Tribunal reviews the case, assesses the proportionality of the penalty, and may reduce it to ₹20 lakhs if it finds the original penalty excessive.

Illustration 2: Appeal by a Data Principal Against Data Deletion Order

Scenario: Mr. Sharma, a data principal, sues a social media platform, SocialConnect, for unauthorized data processing. The DPA rules in favor of Mr. Sharma, ordering SocialConnect to delete all his personal data.

Application of Section 29: SocialConnect challenges the DPA's decision, arguing that some of Mr. Sharma's data is necessary for service provision and that the deletion order violates business continuity. Through Section 29, SocialConnect appeals to the Appellate Tribunal, presenting arguments and evidence that the DPA's order is overly broad and impractical. The Tribunal examines the necessity of the data, the feasibility of deletion, and balances Mr. Sharma's rights with SocialConnect's operational needs, potentially modifying the order to allow selective deletion.

Illustration 3: Appeal Against Procedural Lapses in DPA's Investigation

Scenario: HealthCare Ltd., a hospital chain, faces an investigation by the DPA for alleged non-compliance with data security norms. During the investigation, HealthCare Ltd. claims that the DPA did not provide adequate notice or an opportunity to present its case.

Application of Section 29: HealthCare Ltd. files an appeal to the Appellate Tribunal, asserting that the DPA violated procedural fairness principles, thereby undermining the validity of its findings. The Tribunal reviews the procedural aspects of the DPA's investigation, and if it finds that due process was indeed breached, it may annul the investigation's findings or direct a reinvestigation with proper procedures.

Illustration 4: Appeal by a Data Fiduciary Seeking Reversal of Compliance Directive

Scenario: EduLearn, an online education platform, is directed by the DPA to implement specific data encryption standards within 30 days. EduLearn contends that the directive is technologically unfeasible and financially burdensome.

Application of Section 29: EduLearn appeals to the Appellate Tribunal, providing technical assessments and financial reports demonstrating the impracticality of meeting the DPA's directive within the stipulated timeframe. The Tribunal evaluates the feasibility, potential impact on EduLearn's operations, and the necessity of the directive. It may then extend the deadline, modify the encryption requirements, or provide alternative compliance pathways to balance data protection with operational viability.

Conclusion

Section 29 of the Digital Personal Data Protection Act, 2023 plays a crucial role in ensuring the Act's robust enforcement and the protection of stakeholders' rights. By establishing an Appellate Tribunal, the provision offers an essential mechanism for accountability, fairness, and redressal within the data protection framework. This appellate process not only safeguards the interests of data principals and fiduciaries but also enhances the credibility and effectiveness of the DPDPA by ensuring that regulatory decisions are subject to independent review. Through its structured appeal process, Section 29 fosters a balanced and just data protection environment, promoting trust and compliance in the digital ecosystem.