Your go-to hub for Expert Insights,
Publications, and Resources on
data privacy and compliance

People’s personal data is incredibly valuable, and concerns about companies misusing personal data have sparked a global conversation about the importance of data privacy. Aligning with many international data privacy standards, the Digital Personal Data Protection Act 2023 (DPDPA) regulates how the digital personal data of Indian citizens is processed.

Under this Act, the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) is designated as the appellate authority. This means TDSAT handles appeals from individuals who are unhappy with decisions made by the Data Protection Board of India (DPBI).

Let's dive into TDSAT's role as the appellate tribunal under the DPDPA.

Tribunals in India

An appellate tribunal is a special court or committee set up to review decisions made by another court or committee.

Tribunals like the TDSAT were created to help reduce the backlog of cases and the lengthy procedures in the High Courts and the Supreme Court. They are also essential for resolving disputes that need specialised knowledge, such as issues related to taxes or the environment.

A Tiered Appellate Mechanism

The DPDPA empowers data principals (individuals whose personal data is being processed) with more control over their personal data by granting them certain rights. One of these rights allows data principals to file complaints with the DPBI if they feel their data privacy has been violated by a data fiduciary. According to the 2022 Bill, people could approach the Data Protection Board directly in case of a data breach. However, the 2023 version introduces a new tiered grievance resolution process.

Here's how it works:

• Individuals must first use the grievance redressal process provided by the data fiduciary
• If they're not satisfied, they can then take their complaint to the Data Protection Board
• Finally, appeals from the Board's decisions can be made to an Appellate Tribunal

TDSAT as the Appellate Tribunal

In the 2023 Bill, the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) is designated as the appellate tribunal, unlike the 2022 Draft where appeals went straight to the High Court.

TDSAT was established by the Telecom Services Regulatory Authority Act, 1997 (TRAI Act) to protect both telecom service providers and users. It handles disputes between licensors and licensees, between service providers, or between service providers and consumers.

According to Section 14C of the TRAI Act, the Chairperson of TDSAT is a retired Supreme Court judge or Chief Justice of a High Court. The members are either former Government of India Secretaries or individuals with expertise in technology, telecommunications, industry, commerce, or administration.

How Does the Tribunal Function?

Here are the key provisions of the appellate structure provided for in the DPDP Act.

• Filing Appeals: Appeals must be filed within sixty days of receiving the order, and a fee might be charged. If there's enough reason for a delay, late appeals might be accepted.
• Hearing Appeals: The Appellate Tribunal, which is TDSAT, will hear both parties and decide whether to uphold or overturn the DPB order. It will also send a copy of its decision to the Board and the parties involved.
• Timely Process: TDSAT will be required to expedite the process and resolve appeals within six months. If it takes longer, the reasons for the delay must be documented.
• Further Appeals: If someone is unhappy with TDSAT's decision, provisions of section 18 of the TRAI shall apply. According to this, the aggrieved can appeal to the Supreme Court within ninety days of the Tribunal’s order.
• Digital Operations: The Appellate Tribunal must function digitally, meaning the entire process, from filing to decision-making, should be conducted online as far as practically possible.

·        Additionally, the 2023 Bill gives the Appellate Tribunal powers similar to those of a civil court. This means any order it makes can be enforced like a civil court decree. If TDSAT issues an order, it can send it to a local civil court, which will then enforce the order just as if it had been made by the civil court itself.

·        Concerns Regarding the Unconstitutionality of the Mechanism

·        Many have raised concerns about the appellate mechanism being unconstitutional due to its design flaws.

·        Lack of Independence

·        Tribunals are often criticised for lacking independence and taking jurisdiction away from High Courts. The Central Government appoints and controls the members, and their service terms depend on government rules, unlike judges whose terms are constitutionally defined. This raises doubts about their impartiality.

·        Inadequate Expertise

·        TDSAT members don’t have the necessary knowledge in data protection. Moreover, their three-year terms are too short for them to gain sufficient expertise.

·        These issues undermine the protection of citizens' fundamental rights, especially when the government is involved as a non-compliant data fiduciary.

·        Addressing Grievances the Right Way

·        Concerns about the current appellate structure, particularly the involvement of the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), highlight potential issues with independence and expertise. While the Act aims to streamline the grievance process and promote a digital-first approach, the effectiveness of the TDSAT will be under scrutiny.

·        Along with a well-defined appellate process, ensuring robust compliance tools remains vital as businesses and organisations work to meet DPDP Act requirements.

·        DPDP Consultants specialises in data protection and privacy compliance. Our Data Principal Grievance Redressal (DPGR) tool makes it easy for individuals to raise their privacy concerns through a user-friendly platform. It allows Data Protection Officers or relevant persons to access these requests either manually or automatically, significantly reducing response times and ensuring compliance with government regulations.

We provide customised solutions tailored to your needs and give you the skills, tools, and knowledge to effectively navigate these regulations.

• The DPDPA Readiness Review helps organisations assess the extent of the DPDPA's impact on their operations.
• The Data Protection Consent Management (DPCM) tool ensures valid consent, automating personal data consent requests and establishing a robust system for tracking and handling such requests within companies.
• For existing contracts with data processors, the Contract Review service ensures alignment with DPDP specifications, necessitating revisions when necessary.
• Our dedicated team provides comprehensive DPDPA Compliance Assistance, establishing internal audit frameworks for regulatory alignment and monitoring entities in your supply chain.
• We assist in conducting DPIAs to assess and mitigate risks in data processing. Our Data Protection Impact Assessment (DPIA) tool automates the process, allowing concerned individuals/DPOs to conduct DPIAs through a user-friendly platform. It tracks identified risks and ensures all concerned are informed about mitigation progress.
• Our Data Protection Awareness Program (DPAP) enables regular and mandatory awareness sessions, followed by assessments, ensuring every employee understands the DPDP Act and the repercussions of non-compliance.

Your first step towards safeguarding personal data privacy!

Looking for expert advice from top consultants?

Whether you need guidance on legal compliance consulting or tool-based technical solutions, DPDP Consultants can help you with the best professional services in the industry. Get tailored insights and practical solutions to help you succeed.

For News updates, expert insights, and practical tips on DPDP compliance and personal data security please subscribe to our newsletter Privacy Talks.