Section 54 Indian Data Protection Act 2019

Action to be taken by Authority pursuant to an inquiry

54. (1) On receipt of a report under sub-section (2) of section 53, the Authority may, after giving such opportunity to the data fiduciary or data processor to make a representation in connection with the report as the Authority deems reasonable, by an order in writing

(a) issue a warning to the data fiduciary or data processor where the business or activity is likely to violate the provisions of this Act;

(b) issue a reprimand to the data fiduciary or data processor where the business or activity has violated the provisions of this Act;

(c) require the data fiduciary or data processor to cease and desist from committing or causing any violation of the provisions of this Act;

(d) require the data fiduciary or data processor to modify its business or activity to bring it in compliance with the provisions of this Act;

(e) temporarily suspend or discontinue business or activity of the data fiduciary or data processor which is in contravention of the provisions of this Act;

(f) vary, suspend or cancel any registration granted by the Authority in case of a significant data fiduciary;

(g) suspend or discontinue any cross-border flow of personal data; or

(h) require the data fiduciary or data processor to take any such action in respect of any matter arising out of the report as the Authority may deems fit. (2) A data fiduciary or data processor aggrieved by an order made under this section may prefer an appeal to the Appellate Tribunal.