TDSAT and the Future of Adjudication of Data Protection Disputes
Introduction
The Digital Personal Data Protection Act, 2023 (DPDP Act) was enacted to secure the rights of data principals with respect to how different data fiduciaries handle their personal data. The most important aspects of safeguarding these rights are the proper enforcement and adjudication. The DPDP Act provides for a two-tier adjudication mechanism which consists of the Data Protection Board (DPB) and the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Though concerns have been raised with respect to the pervasive governmental control over the DPB, this blog will shed light on TDSAT’s ability to deal with disputes under the DPDP Act as an appellate authority.
TDSAT: The Appellate Tribunal Under the DPDP Act
In 2018, the B.N. Srikrishna Committee Report suggested the establishment of an appellate tribunal or the conferment of such powers to an existing tribunal if it had the competence to deal with data protection law. The Data Protection Bill of 2022 provided for the High Court as an appellate forum to decide disputes. The former suggestion was finally incorporated granting power to an existing tribunal i.e. the TDSAT. But does the TDSAT have the competence to adjudicate data protection disputes as envisaged by the committee?
According to Section 2(a) read with Section 29 of the DPDP Act, TDSAT is the appellate authority to decide disputes under the Act. The TDSAT was established under Section 14 of the Telecom Regulatory Authority of India Act, 1997 (TRAI Act) as an appellate tribunal to adjudicate telecom disputes between a licensor and a licensee; between two or more service providers; and between a service provider and consumers. The preamble to the TRAI Act explicitly emphasised the intent behind its enforcement which was to promote the growth of the telecom sector. On the other hand, the purpose of the DPDP Act was to protect personal data of individuals and regulate the processing of such personal data.
This foundational conflict is evident from the provisions of both Acts. Section 19 of the DPDP Act provides that the Chairperson and members of the DPB shall possess knowledge of data governance. Conversely, Section 14C of the TRAI Act enlists knowledge of telecommunication as a requirement for a technical member. Moreover, no member can hold office for a period exceeding 3 years. Therefore, the statutory term would not provide the adequate opportunity to equip existing members with knowledge and expertise of data protection law.
The Current Status of TDSAT
As on date, the TDSAT has only 2 members. One is a judicial member who served as a judge in Allahabad High Court. On 16 October 2025, a technical member was appointed to the TDSAT who is an expert in telecommunication and has knowledge of cyber law, cyber crime investigation and digital forensics. Despite the fact that the DPDP Act has provided for TDSAT as an appellate authority for data protection disputes, the most recent appointment does not reflect knowledge and expertise of data protection law. If the members are appointed on the basis of the requirements under the TRAI Act, adjudication under the DPDP Act will eventually suffer.
The TDSAT is already burdened with a lot of pendency of cases. In February 2025, there were 3,448 pending cases. As there is only one bench and limited members to adjudicate disputes, it seems that the TDSAT would not be able to efficaciously deal with the added burden of disputes emerging from the DPDP Act. This will lead to the frustration of the purpose of the DPDP Act and will hinder data principals from enforcing their rights. Furthermore, it will be difficult for the TDSAT to comply with the 60 day time limit to decide appeals under Section 29 of the DPDP Act.
Way Forward
The ideal situation would have been to establish a separate appellate tribunal in order to deal with data protection disputes. As the government has already clarified that the DPDP Act will not go through any further amendments, it can be fathomed that the TDSAT will remain the appellate authority for the purposes of the DPDP Act. Necessary amendments in the TRAI Act can also remedy the situation. The addition of more members having knowledge of data protection law, multiple benches to share the burden and allotment of an adequate budget are some steps that might be taken in this direction, but what will be the course in this regard ultimately depends on how the DPDP Act will be rolled out.
