What is the Data Protection Board of India?

It is the regulator and adjudicator under the DPDP Act. Sec. 18 establishes it as a body corporate with perpetual succession, and Sec. 2(c) defines it. It receives breach intimations and complaints, inquires into them, directs remedial measures and imposes monetary penalties under Sec. 27 and Sec. 33.

Who sits on the Data Protection Board?

A Chairperson and such number of Members as the Central Government notifies, appointed by the Central Government under Sec. 19. They must have special knowledge or experience in fields such as data governance, law, regulation or techno-regulation, and at least one must be an expert in law. Each holds office for two years and can be reappointed under Sec. 20(2).

Is the Data Protection Board of India operational?

In law, yes; in practice it was still being staffed as of 12 October 2026, on public reporting. The provisions establishing it commenced on 13 November 2025, and MeitY invited applications for the Chairperson and Members in May 2026. Check the current position, since it is the part most likely to have changed.

How do I file a complaint with the Data Protection Board?

Complain to the Data Fiduciary or Consent Manager first, because Sec. 13(3) requires you to exhaust its grievance redressal before approaching the Board. The Board functions as a digital office under Sec. 28(1) and Rule 20, so complaints are received and heard digitally. It can warn or impose costs on a complainant whose complaint is false or frivolous, under Sec. 28(12).

Data Protection Board of India: Powers

The Data Protection Board of India is the body that enforces the DPDP Act. It receives complaints and breach intimations, decides whether to inquire, hears the person concerned, and can direct remedial action and impose the monetary penalties in the Schedule to Sec. 33(1). It also registers Consent Managers. Its orders can be appealed to the Telecom Disputes Settlement and Appellate Tribunal.

Chapter V (Sec. 18 to 26) deals with what the Board is and who sits on it, Chapter VI (Sec. 27 and 28) with what it does, and Chapter VII (Sec. 29 to 32) with appeals, mediation and voluntary undertakings. Rules 17 to 21 and 22 fill in the machinery.

Establishment and current status

Sec. 18(1) establishes a Board called the Data Protection Board of India from a date the Central Government appoints. Sec. 18(2) makes it a body corporate with perpetual succession and a common seal, able to hold property, contract, and sue or be sued. The Central Government notifies its headquarters under Sec. 18(3).

The provisions establishing the Board commenced on 13 November 2025, when Rules 1, 2 and 17 to 21 came into force. Having a legal basis is not the same as being staffed. MeitY invited applications for the Chairperson and the four Members in May 2026, and the Rules timeline records the Board as established in law but not yet staffed. As of 12 October 2026, on public reporting, that had not changed. Until the appointments complete, no forum is hearing complaints. Check the present position before relying on this; it is the point most likely to have moved.

One provision in Sec. 23(2) is worth knowing: no act or proceeding of the Board is invalid merely because of a vacancy in, or defect in the constitution of, the Board. A thinly staffed Board does not make its orders invalid by that fact alone, though Rule 19(3) still sets the quorum at one-third of the membership.

Who sits on it

Sec. 19 sets the composition. The Board has a Chairperson and as many other Members as the Central Government notifies, all appointed by the Central Government. They must be persons of ability, integrity and standing with special knowledge or practical experience in fields such as data governance, administration or implementation of laws on social or consumer protection, dispute resolution, information and communication technology, the digital economy, law, regulation or techno-regulation. At least one must be an expert in law.

Rule 17 describes how they are chosen. A Search-cum-Selection Committee chaired by the Cabinet Secretary, with the Secretaries for Legal Affairs and for the Ministry of Electronics and Information Technology and two experts, recommends the Chairperson. A separate committee chaired by the MeitY Secretary recommends the other Members. The Central Government appoints after considering the recommendations.

Term: two years, with eligibility for reappointment (Sec. 20(2)).
Pay and conditions: set by the Fifth Schedule (Rule 18), and not varied to a Member's disadvantage after appointment (Sec. 20(1)).
Disqualification: insolvency, a conviction involving moral turpitude in the Government's opinion, incapacity, a prejudicial financial or other interest, or abuse of position (Sec. 21(1)). Removal requires a hearing (Sec. 21(2)).
Afterwards: for one year after leaving, no employment without the Central Government's approval, and any later employment with a Data Fiduciary that was before them must be disclosed (Sec. 22(3)).

The Chairperson holds the administrative powers and can allocate proceedings to individual Members or groups (Sec. 26). Staff are appointed with Government approval (Sec. 24, Rule 21) on terms in the Sixth Schedule.

What the Board does

Sec. 27(1) lists five functions. In plain terms, the Board:

on receiving a breach intimation under Sec. 8(6), can direct urgent remedial or mitigation measures, inquire into the breach and impose a penalty;
on a Data Principal's complaint about a breach or about a Data Fiduciary's observance of its obligations or her rights, or on a reference from the Central or a State Government or a court direction, inquires and imposes a penalty;
on a complaint against a Consent Manager, inquires and imposes a penalty;
on intimation of breach of a Consent Manager's registration condition, inquires and imposes a penalty;
on a Central Government reference about an intermediary's breach of Sec. 37(2), inquires and imposes a penalty.

Beyond those, Sec. 27(2) lets the Board issue directions it considers necessary, after hearing the person and recording reasons, and the person is bound to comply. Sec. 27(3) lets it modify, suspend, withdraw or cancel a direction on a representation. The Board also registers Consent Managers and can suspend or cancel registration under Rule 4; see what a Consent Manager is.

How an inquiry runs

Sec. 28 sets the procedure. The Board functions as an independent body and, as far as practicable, as a digital office, with complaints received and hearings and decisions "digital by design" (Sec. 28(1), Rule 20).

The Board first decides whether there are sufficient grounds to proceed. If not, it can close the proceedings with reasons recorded (Sec. 28(3), (4)).
If so, it inquires, following natural justice and recording reasons (Sec. 28(5), (6)).
It has the powers of a civil court to summon and examine on oath, receive evidence by affidavit, and inspect documents (Sec. 28(7)). It cannot block access to premises or take custody of equipment that adversely affects day-to-day functioning (Sec. 28(8)).
It can issue interim orders after hearing the person (Sec. 28(10)).
On completion, after a hearing, it either closes the proceedings or moves to a penalty under Sec. 33 (Sec. 28(11)).

Rule 19(9) requires the inquiry to be completed within six months of the intimation, complaint, reference or direction, extendable by recorded reasons by up to three months at a time. The Board can also direct parties to try mediation (Sec. 31) or accept a voluntary undertaking (Sec. 32). How penalties are set is covered in DPDP penalties.

Appeal to the Tribunal

Sec. 29 sends appeals to the Appellate Tribunal, defined in Sec. 2(a) as the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The time limit is sixty days from receipt of the order, with late appeals allowed on sufficient cause. The Tribunal can confirm, modify or set aside the order, and should endeavour to decide within six months.

Rule 22 sets the procedure: filing in digital form, a fee like that for an appeal under the Telecom Regulatory Authority of India Act, 1997 (payable by UPI or another RBI-authorised system, and reducible or waivable by the Tribunal's Chairperson), and a Tribunal that is not bound by the Code of Civil Procedure but guided by natural justice. Rule 22 commences on 13 May 2027 under Rule 1(4), so the appeal procedure is not live before then. Sec. 39 bars civil courts from hearing matters the Board can decide.

What this means for you

For a Data Fiduciary, the Board is where a breach intimation under Sec. 8(6) lands, so what you tell it, and how fast, is the start of any proceeding. Rule 7 sets the clocks. For a Data Principal, the route to the Board runs through the Fiduciary's grievance mechanism first, covered in the rights guide.

The Board's staffing does not change your duties. They commence on 13 May 2027 regardless (Rule 1(4)), and the compliance map ties each to a control.

The Board that enforces the Act