The Data Protection Board of India (DPBI) is the statutory authority established under the Digital Personal Data Protection Act, 2023 (DPDP Act) to oversee compliance with India's digital personal data protection framework. It is designed to examine personal data breaches, address violations of the law, issue appropriate directions and impose monetary penalties when the statutory provisions apply.
The Board is an important part of India's effort to protect individuals' digital personal information and make organisations accountable for how they collect, use, store and process personal data.
However, there is an important distinction between the Board's legal establishment and the commencement of its enforcement powers. The Government established the Board in November 2025, but the DPDP Act follows a phased implementation schedule. Most of the provisions dealing with data-processing obligations, individual rights, inquiries and monetary penalties are scheduled to commence on 13 May 2027.
This guide explains what the Data Protection Board of India is, its legal basis, proposed powers, organisational structure, implementation status and the role it will play under the DPDP Act.
What Is the Data Protection Board of India?
The Data Protection Board of India is an independent adjudicatory authority established by the Central Government under Section 18 of the Digital Personal Data Protection Act, 2023.
Its primary purpose is to examine alleged non-compliance with the DPDP Act and enforce the obligations prescribed under the law. It will also provide a statutory mechanism through which individuals can seek action in matters falling within the Board's jurisdiction.
The Government formally established the Board through Notification G.S.R. 844(E), dated 13 November 2025. The notification created the Board as a body corporate and specified its head office in the National Capital Region.
You can read the official notification establishing the Data Protection Board of India.
The Board is intended to function as a digital-by-design institution. This means that its proceedings and administrative processes are designed to use digital systems rather than depend entirely on conventional physical hearings and paperwork.
What Is the Legal Basis of the Data Protection Board?
The Digital Personal Data Protection Act, 2023 provides the legal foundation for the Board. The Act received the President's assent on 11 August 2023 and establishes a framework for processing digital personal data while recognising individuals' rights and the lawful purposes for which organisations may process their information.
Section 18 of the Act provides for the establishment of the Data Protection Board of India. Other provisions explain its composition, appointment process, powers, procedure and related responsibilities.
The Government notified the DPDP Act commencement notification, G.S.R. 843(E), dated 13 November 2025. It brought different provisions of the Act into force in stages.
The Government also notified the Digital Personal Data Protection Rules, 2025 to provide the detailed procedures and implementation framework under the Act.
What Is the Composition of the Data Protection Board of India?
Under Section 19 of the DPDP Act and the Government's notification regarding its composition, the Data Protection Board of India consists of:
- One Chairperson: The head of the Board.
- Four Members: Members appointed by the Central Government to participate in the Board's statutory functions.
The Central Government notified that the Board would consist of four Members through Notification G.S.R. 845(E), dated 13 November 2025.
The appointment framework seeks individuals with relevant knowledge and professional experience in areas such as data governance, law, administration, consumer protection, dispute resolution, information technology and regulation.
At least one Member must have expertise in the field of law, as reflected in the Government's recruitment framework.
Read the MeitY circular dated 6 May 2026 inviting applications for the Chairperson and Members for the appointment requirements.
What Is the Current Status of the Data Protection Board of India?
The Government has legally established the Data Protection Board of India. However, its establishment, appointment of office-holders and commencement of enforcement powers are separate matters.
Legal Establishment of the Board
The Board was established on 13 November 2025 under Section 18 of the DPDP Act. The relevant provisions concerning its establishment and institutional framework have commenced.
Appointment of the Chairperson and Members
On 6 May 2026, the Ministry of Electronics and Information Technology issued a circular inviting applications for one Chairperson and four Member positions. The recruitment advertisement was subsequently published in the Employment News on 6 June 2026.
In its reply to Lok Sabha Unstarred Question No. 3960 on 12 August 2026, the Government explained the appointment process and confirmed the publication of the recruitment advertisement. That reply did not identify appointed office-holders.
As of this article's review date, 10 November 2026, I could not verify a later official MeitY or Gazette announcement confirming the completed appointments. Readers should therefore not assume that the Board is fully staffed merely because it has been legally established.
Commencement of the Board's Enforcement Powers
The Board's enforcement powers are also subject to the commencement schedule notified under the DPDP Act. The Government has not brought all provisions into force at the same time.
For example, the main inquiry and enforcement framework under Sections 27 and 28 is scheduled to commence on 13 May 2027, except for Section 27(1)(d), which has a separate one-year commencement date.
Therefore, the Board's legal existence should not be confused with its ability to exercise every power described in the Act.
When Will the DPDP Act and Rules Come Into Force Completely?
The Government introduced a phased implementation schedule to give organisations and other stakeholders time to prepare for the new data protection framework.
The commencement notification dated 13 November 2025 divides the implementation into three stages.
| Implementation stage | Provisions and activities | Applicable date |
|---|---|---|
| First stage | Definitions, establishment and composition of the Board, appointment-related provisions and specified institutional and administrative provisions. | 13 November 2025 |
| Second stage | Section 6(9), concerning Consent Managers, and Section 27(1)(d), concerning specified breaches of Consent Manager registration conditions. | 13 November 2026 |
| Third stage | Most substantive data-processing obligations, individual rights, security safeguards, breach notification requirements, inquiry procedures, appeals and monetary penalty provisions. | 13 May 2027 |
Important: The one-year milestone falls on 13 November 2026, just after this article's review date. It does not bring the entire DPDP framework into force. The main compliance and enforcement provisions remain scheduled for 13 May 2027 under the notified timetable.
For the exact legal position, refer to the official commencement notification rather than relying only on general summaries of the implementation schedule.
What Is Digital Personal Data Under the DPDP Act?
The DPDP Act deals with the processing of digital personal data. It aims to establish rules for organisations that handle individuals' personal information in digital form.
The Act also covers personal data collected in non-digital form and subsequently digitised, as well as certain processing outside India connected with offering goods or services to individuals in India.
Some important terms used in the Act are:
Data Principal
A Data Principal is the individual to whom the personal data relates. For example, if a company collects your name, contact details or other personal information, you are the Data Principal in relation to that information.
Data Fiduciary
A Data Fiduciary is the person or organisation that determines the purpose and means of processing personal data. It is responsible for ensuring that the processing complies with the applicable legal requirements.
Data Processor
A Data Processor is an entity that processes personal data on behalf of a Data Fiduciary. For example, a company may engage an external service provider to store or process customer information.
The Act also contains specific provisions for Significant Data Fiduciaries, who may have additional obligations based on the criteria and notifications prescribed by the Central Government.
These definitions help identify the responsibilities of individuals, organisations and service providers within the data protection framework.
What Are the Main Functions of the Data Protection Board of India?
The Board is designed to serve as the adjudicatory and enforcement authority under the DPDP Act. Its responsibilities connect individual data protection rights with legal accountability for organisations.
1. Examining Personal Data Breaches
One of the Board's important functions is to examine matters involving personal data breaches and alleged non-compliance with the DPDP Act.
A personal data breach may involve unauthorised processing, disclosure, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.
Under the applicable provisions, the Board will be able to examine whether the responsible organisation has fulfilled its statutory obligations and whether further action is necessary.
2. Addressing Violations by Data Fiduciaries
Data Fiduciaries have responsibilities under the DPDP Act. These include obligations relating to lawful processing, security safeguards, breach notification, grievance redressal and other applicable requirements.
The Board is intended to examine alleged failures by Data Fiduciaries and take action within its statutory jurisdiction. This will help establish accountability when organisations do not follow the applicable data protection requirements.
3. Supporting the Rights of Data Principals
The DPDP Act recognises several rights of individuals, including the right to access information about personal data processing, correction, completion, updating, erasure, grievance redressal and nomination, subject to the conditions and exceptions in the law.
For example, an individual may seek correction of inaccurate personal information or request erasure where the law permits it. If an organisation does not properly address a grievance, the statutory framework provides a route for approaching the Board after following the prescribed grievance-redressal process.
These rights are part of the substantive provisions scheduled to commence in May 2027. They should not be presented as fully enforceable under the DPDP Act on the basis of the Board's establishment alone.
4. Overseeing Consent Managers
Consent Managers are entities that provide individuals with a platform to give, manage, review and withdraw consent through an accessible and transparent process.
The DPDP Rules, 2025 provide for the registration and regulation of Consent Managers. The Board has responsibilities relating to their registration and compliance with the prescribed conditions.
These responsibilities include examining registration applications, issuing appropriate directions and taking action where a Consent Manager fails to comply with applicable registration conditions.
The relevant Consent Manager provisions have a separate implementation milestone on 13 November 2026. They should be distinguished from the broader enforcement framework scheduled for May 2027.
Read the Digital Personal Data Protection Rules, 2025 for the prescribed Consent Manager framework.
5. Issuing Directions for Mitigation and Remediation
The DPDP Act provides for the Board to issue appropriate directions in matters falling within its jurisdiction. These may include directions requiring an organisation to take corrective steps or mitigate the consequences of a personal data breach.
Such directions are intended to address non-compliance and reduce the impact of violations. The Board must exercise these powers in accordance with the relevant provisions and procedural safeguards.
6. Promoting Accountability Through Monetary Penalties
The Board will have the authority to impose monetary penalties for specified violations of the DPDP Act after following the prescribed procedure.
The penalty framework is designed to make organisations take their data protection responsibilities seriously. The amount depends on the nature of the violation and the relevant provision of the Act.
What Are the Monetary Penalties Under the DPDP Act?
The DPDP Act provides for significant monetary penalties for certain types of non-compliance. The maximum amounts are specified in the Schedule to the Act.
| Type of non-compliance | Maximum monetary penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent personal data breaches | Up to ₹250 crore |
| Failure to notify the Board or affected Data Principals about a personal data breach as required by the Act | Up to ₹200 crore |
| Failure to fulfil obligations relating to children's personal data | Up to ₹200 crore |
| Failure by a Significant Data Fiduciary to fulfil its additional obligations | Up to ₹150 crore |
| Other violations of the Act or applicable rules | Up to ₹50 crore |
These figures are maximum penalty limits, not automatic fines. The Board must consider the facts and circumstances of the case and follow the statutory procedure before imposing a penalty.
The framework allows consideration of factors such as the nature, gravity and duration of the breach, the type of personal data affected, the measures taken to mitigate the consequences and the overall impact of the violation.
You can check the penalty provisions in the Digital Personal Data Protection Act, 2023.
How Will the Data Protection Board Conduct Inquiries?
The DPDP Act and Rules provide for a structured inquiry process. The Board is intended to use digital procedures while ensuring that the concerned parties receive a fair opportunity to present their cases.
Digital Proceedings
The Board is designed to function as a digital office. This approach can make proceedings more accessible and reduce the need for routine physical appearances.
Digital proceedings may involve electronic submission of information, documents and responses, subject to the applicable rules and directions.
Examination of Evidence
During an inquiry, the Board will be able to use the powers provided under the Act to examine relevant information and evidence. These include powers relating to summoning individuals, examining witnesses and requiring documents.
Opportunity to Be Heard
The Board must follow the principles of natural justice. This means that a person or organisation affected by an adverse decision should receive an appropriate opportunity to present its case, subject to the law.
Reasoned Orders
Decisions must be supported by reasons. A reasoned order helps explain the legal and factual basis of the Board's decision and provides clarity to the parties involved.
The inquiry and procedural provisions are part of the later implementation phase scheduled for May 2027.
Can You Appeal Against a Decision of the Data Protection Board?
Yes. The DPDP Act provides for an appeal against an order or direction of the Data Protection Board to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
TDSAT is the statutory appellate forum under the Act. An affected person can approach the Tribunal in accordance with the prescribed procedure and applicable time limits.
The appeal mechanism is intended to provide an additional level of legal scrutiny over the Board's decisions. The relevant appeal provisions are scheduled to commence in the later implementation phase.
What Is the Difference Between the Data Protection Board and MeitY?
The Ministry of Electronics and Information Technology (MeitY) and the Data Protection Board of India have different responsibilities within the data protection framework.
| Basis | MeitY | Data Protection Board of India |
|---|---|---|
| Nature | Central Government ministry | Statutory adjudicatory authority |
| Primary role | Policy, legislation, rules and administration of the digital technology framework | Enforcement and adjudication under the DPDP Act |
| Key responsibility | Notifying rules, issuing relevant notifications and administering the framework | Examining alleged violations and imposing penalties under applicable provisions |
| Legal basis | Government of India and relevant statutory powers | Section 18 and other applicable provisions of the DPDP Act |
In simple terms, MeitY is responsible for the Government's policy and regulatory framework, while the Board is intended to examine compliance and adjudicate matters assigned to it under the Act.
What Is the Difference Between the Data Protection Board and CERT-In?
The Data Protection Board and the Indian Computer Emergency Response Team (CERT-In) both operate within India's broader digital security environment, but their legal responsibilities are different.
| Basis | Data Protection Board | CERT-In |
|---|---|---|
| Legal basis | Digital Personal Data Protection Act, 2023 | Section 70B of the Information Technology Act, 2000 |
| Primary focus | Compliance with digital personal data protection requirements | Cybersecurity incident response and coordination |
| Key activities | Examining alleged violations, issuing directions and imposing monetary penalties under the DPDP Act | Handling cybersecurity incidents, issuing alerts and advisories, and coordinating technical responses |
| Area of responsibility | Personal data protection and statutory compliance | Cybersecurity incidents affecting computer systems and networks |
A personal data breach may also involve a cybersecurity incident. In such cases, the responsibilities of different institutions may overlap, but their legal functions remain separate.
For a detailed explanation of India's cybersecurity incident response system, read our guide on CERT-In and its role in India's cybersecurity framework.
How Does the DPDP Act Protect Individuals' Personal Information?
The DPDP framework aims to give individuals greater control over their digital personal information while establishing responsibilities for organisations that process it.
Some of the important protections under the Act include:
- Notice and consent: Organisations must follow the applicable requirements for informing individuals and obtaining valid consent where consent is the lawful basis for processing.
- Security safeguards: Data Fiduciaries must implement reasonable security measures to protect personal data.
- Breach notification: Organisations must notify the Board and affected individuals about personal data breaches as required by the law.
- Correction and erasure: Individuals receive rights to seek correction, completion, updating and erasure of personal data, subject to legal conditions.
- Grievance redressal: Individuals can use the prescribed grievance-redressal process and approach the Board where the law permits.
- Protection of children's data: The Act provides additional requirements for processing children's personal data.
- Accountability: The Board provides an enforcement mechanism for specified violations of the framework.
These substantive rights and obligations are subject to the notified commencement schedule. Most are scheduled to take effect on 13 May 2027.
The DPDP framework is also part of a wider effort to strengthen privacy and digital security in India. For example, our guide to UIDAI, Aadhaar security and data protection explains the safeguards and privacy-related features associated with Aadhaar.
What Are the Limits of the Data Protection Board's Powers?
The Data Protection Board has a specific statutory role. It is not a general-purpose authority for every dispute involving privacy, cybercrime or misuse of digital information.
- It is not a police investigation agency: Criminal investigations involving hacking, identity theft, financial fraud or other offences remain with the appropriate law enforcement authorities.
- It does not automatically provide personal compensation: Monetary penalties imposed under the DPDP Act are credited to the Consolidated Fund of India. They are not automatically paid to the affected individual as compensation.
- It does not regulate every kind of personal information dispute: Its jurisdiction is defined by the DPDP Act and applicable rules.
- It must follow statutory procedures: The Board cannot impose penalties or issue adverse directions without following the relevant legal requirements.
- Exemptions apply: The DPDP Act contains specified exemptions and exclusions that affect its application in particular circumstances.
For example, if someone loses money through an online banking scam, the matter should be reported through the appropriate cybercrime and banking complaint channels. The Data Protection Board is not a substitute for the police or the banking grievance-redressal system.
Frequently Asked Questions About the Data Protection Board of India
Q. What is the Data Protection Board of India?
Ans. The Data Protection Board of India is a statutory adjudicatory authority established under Section 18 of the Digital Personal Data Protection Act, 2023. It is responsible for examining alleged violations and enforcing the provisions of the Act when the relevant powers commence.
Q. When was the Data Protection Board of India established?
Ans. The Central Government established the Data Protection Board of India on 13 November 2025 through Notification G.S.R. 844(E) under Section 18 of the DPDP Act, 2023.
Q. Is the Data Protection Board of India fully operational?
Ans. The Board has been legally established, and the Government initiated the appointment process for its Chairperson and four Members in 2026. As of 10 November 2026, this review could not verify a later official announcement confirming completed appointments. Most of the Board's main enforcement powers are separately scheduled to commence on 13 May 2027.
Q. How many members are there in the Data Protection Board of India?
Ans. The Board consists of one Chairperson and four other Members, as specified under the applicable provisions and the Government's notification regarding its composition.
Q. Under which Act was the Data Protection Board established?
Ans. The Data Protection Board was established under the Digital Personal Data Protection Act, 2023. Section 18 provides for its establishment, while other provisions explain its composition, powers and procedure.
Q. What are the main functions of the Data Protection Board?
Ans. Its main functions include examining personal data breaches, addressing non-compliance by Data Fiduciaries, issuing appropriate directions, overseeing Consent Managers under the applicable framework and imposing monetary penalties for specified violations.
Q. What is the maximum penalty under the DPDP Act?
Ans. The maximum monetary penalty can reach ₹250 crore for failure to take reasonable security safeguards to prevent personal data breaches. Other violations carry separate maximum penalty limits, including ₹200 crore for specified breach-notification failures and children's data obligations.
Q. Can an individual file a complaint with the Data Protection Board?
Ans. The DPDP Act provides a mechanism for individuals to approach the Board in matters within its jurisdiction after following the prescribed grievance-redressal process. However, the main complaint and inquiry framework is scheduled to commence on 13 May 2027.
Q. What is the difference between a Data Principal and a Data Fiduciary?
Ans. A Data Principal is the individual whose personal data is being processed. A Data Fiduciary is the person or organisation that determines the purpose and means of processing that personal data.
Q. Does the Data Protection Board investigate cybercrime cases?
Ans. No. The Board's role concerns compliance with the DPDP Act. Criminal investigations involving hacking, online fraud, identity theft and other cyber offences are handled by the appropriate law enforcement authorities.
Q. Can the Data Protection Board impose penalties on companies?
Ans. Yes. The DPDP Act provides for monetary penalties against organisations that violate specified provisions. However, the Board must follow the statutory inquiry and enforcement procedure, and the main penalty provisions are scheduled to commence on 13 May 2027.
Q. Where can a person appeal against a Data Protection Board order?
Ans. The DPDP Act provides for appeals against the Board's orders and directions before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), subject to the applicable statutory provisions and commencement dates.
Conclusion
The Data Protection Board of India is an important institution in the country's digital personal data protection framework. Established under Section 18 of the DPDP Act, 2023, it is designed to examine violations, address personal data breaches, oversee relevant compliance matters and impose monetary penalties under the law.
However, readers should distinguish between the Board's legal establishment, the appointment of its Chairperson and Members, and the commencement of its enforcement powers. The Government has notified a phased implementation schedule, with the main data-processing obligations, individual rights and enforcement provisions scheduled to commence on 13 May 2027.
As the framework progresses, the Board is expected to play a central role in making organisations accountable for their handling of digital personal data and strengthening individuals' privacy protections in India.