Context

• In January 2025, the Ministry of Electronics and Information Technology (MeitY) unveiled the draft Digital Personal Data Protection Rules (Rules) under the Digital Personal Data Protection Act (Act) of 2023.
• These regulations are poised to impact India's data protection landscape, but several critiques have emerged, notably around the Union government's discretion in appointing members to the Data Protection Board (DPB).
• Therefore, it is important to explore the institutional reforms necessary for the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) to effectively handle these appeals.

Concerns Surrounding the Rules Under the Act of 2023

• Executive Control Over the Data Protection Board (DPB)
  • A significant concern with the draft Rules is the Union government’s discretion in appointing members to the DPB, a quasi-judicial body responsible for resolving disputes related to personal data protection.
  • The Rules grant the government considerable control over the selection of members of the DPB, which has raised alarms about the separation of powers and the independence of the Board.
• Appeals Process and the Role of the TDSAT
  • Another area of concern lies in the appeal process outlined in the draft Rules.
  • As per the Rules, appeals against decisions made by the DPB will be filed digitally before the
  • The TDSAT will be required to dispose of these appeals within a strict six-month timeline.
  • While the intention to ensure timely resolution is commendable, several issues arise regarding the feasibility of this approach.
  • The TDSAT is already overburdened with an extensive backlog of cases, particularly from the telecommunications sector, which already occupies a significant portion of the tribunal’s time.
• Absence of Specialised Knowledge in Data Protection
  • The draft Rules also raise concerns about the need for specialised expertise in data protection within the TDSAT.
  • Tribunals typically deal with sector-specific matters and appoint technical members with expertise in the relevant fields.
  • However, the issues surrounding data protection are distinct from those related to telecommunications or general governance and require a specialized understanding of privacy laws, consent mechanisms, and the nuances of data processing, storage, and transfer.
  • Currently, the TDSAT is not equipped with technical members who possess expertise in data protection.
• Lack of Technological Infrastructure for Digital Filings
  • The draft Rules also propose that appeals be filed in digital form.
  • While this aligns with the move toward digital governance, there are concerns about the adequacy of the TDSAT’s technological infrastructure to support such filings.
  • The tribunal's current digital infrastructure has been criticised for its limited user-friendliness and accessibility, with many stakeholders expressing a lack of confidence in the system.
• Lack of Transparency and Accountability
  • Finally, there is a concern about the lack of transparency and accountability in the implementation of the Digital Personal Data Protection Act and the functioning of the DPB and TDSAT.
  • The draft Rules do not explicitly provide for the publication of detailed annual reports or data on the functioning of these bodies.
  • Public access to information about the number of appeals filed, the outcomes of cases, and the types of issues addressed is crucial for ensuring accountability and maintaining public trust.
  • The absence of such transparency makes it difficult for stakeholders to assess how well the system is working and whether the rights of individuals are being effectively protected.

Necessary Institutional Reforms

• The Need for a Specialist: Data Protection Expertise
  • The first necessary reform involves ensuring that the TDSAT has the required expertise in data protection.
  • For the TDSAT to handle data protection appeals competently, Section 14C of the Telecom Regulatory Authority of India Act, 1997 must be amended to stipulate the appointment of a technical member with expertise in data protection.
  • Without such an amendment, the TDSAT would struggle to adjudicate data protection issues effectively, as these matters are inherently different from telecommunications concerns.
• The Burden of Cases: The TDSAT’s Overburdened Docket
  • The TDSAT’s current capacity to handle appeals from the DPB must be addressed. The TDSAT is already grappling with a backlog of cases.
  • Between February 2020 and February 2025, 3,448 cases remain pending.
  • The growing caseload, especially with the increasing volume of appeals under the newly enacted Telecommunications Act, will only exacerbate the burden on the tribunal.
  • It is unrealistic to expect the TDSAT to meet the Act’s six-month timeline for disposing of appeals under these circumstances.
  • Increased budget allocations are needed to fund additional benches and resources for the TDSAT.
  • Such investments would alleviate the current backlog and ensure that the tribunal is better equipped to manage the rising number of appeals under the Act.
• Technological Updates: Adapting to Digital Filings
  • The third reform concerns the technological infrastructure required to support the digital filing of appeals, as stipulated in the draft Rules.
  • A robust digital system is crucial to handling the expected volume of data protection appeals efficiently.
  • To ensure that the TDSAT can process digital filings smoothly, the tribunal's website must undergo significant updates.
  • These improvements should focus on user-friendly navigation, improved access to case information, and efficient mechanisms for digital submissions.
  • Without these upgrades, the TDSAT will struggle to manage the expected influx of data protection cases, further hindering its capacity to meet the six-month deadline for appeals.
• Ensuring Accountability and Transparency
  • To ensure the TDSAT remains accountable in its expanded role, the publication of annual reports is essential.
  • These reports should provide a comprehensive overview of the tribunal’s performance, detailing the number of appeals filed, the outcomes of these appeals, and any outstanding cases.
  • Specifically, information on the appeals related to data protection, telecommunications, and broadcasting should be presented separately to allow for targeted analysis.
  • Such transparency will help foster public trust in the tribunal’s ability to handle complex and sensitive data protection issues.

Conclusion

• The draft Digital Personal Data Protection Rules of 2025 outline a significant shift in India's digital governance framework, with the TDSAT positioned as the appellate body for data protection issues.
• However, for this system to function effectively, the TDSAT requires substantial institutional reforms.
• By implementing reforms, the TDSAT will be better equipped to manage data protection appeals and uphold the rule of law in India's rapidly evolving digital landscape.