(1) The Board shall exercise and perform the following powers and functions, namely:—
- on receipt of an intimation of personal data breach under sub-section (6) of section 8, the Board may direct urgent remedial or mitigation measures, inquire into such breach, and impose penalties in accordance with the provisions of this Act;
- on a complaint made by a Data Principal regarding a personal data breach or a breach in the observance of obligations of a Data Fiduciary or Consent Manager, or on a reference made by the Central Government or a State Government, or in compliance with the directions of any court, the Board shall inquire into such breach and impose penalties in accordance with the provisions of this Act;
- on a complaint by a Data Principal regarding a breach of obligations of a Consent Manager, the Board shall inquire into such breach and impose penalties in accordance with the provisions of this Act;
- on receipt of an intimation of a breach of any condition of registration of a Consent Manager, the Board shall inquire into such breach and impose penalties in accordance with the provisions of this Act; and
- on a reference made by the Central Government regarding a breach of the provisions of sub-section (2) of section 37 by an intermediary, the Board shall inquire into such breach and impose penalties in accordance with the provisions of this Act.
(2) For the effective discharge of its functions under this Act, the Board may, after giving the person concerned an opportunity of being heard and for reasons to be recorded in writing, issue such directions as it may consider necessary, which the person shall be bound to comply with.
(3) The Board may, on a representation made to it by a person affected by a direction issued under sub-section (1) or sub-section (2), or on a reference made by the Central Government, modify, suspend, withdraw, or cancel such direction and may impose fresh terms and conditions while doing so.