The Data Protection Board of India
A digital-by-design adjudicatory body under the DPDP Act 2023. It hears complaints, opens inquiries, and imposes penalties under the four caps set by the Schedule. As of August 2026, the Board is legally constituted but no members have been appointed.
01Live status
The Board has not been seated. No Chairperson. No Members. No orders.
MeitY invited applications for the Chairperson and four Members on 6 May 2026 (F. No. 2(1)/2026-Pers.I), with a follow-up notification on 6 June 2026. The Cabinet Secretary heads the search-cum-selection committee constituted under Rule 18. As of August 2026, no appointments have been announced. The Board's website exists as a placeholder at dpbindia.gov.in but does not accept complaints.
02Composition and appointment
Under Section 19, the Board consists of a Chairperson and up to four other Members. All are appointed by the Central Government on the recommendation of the search-cum-selection committee.
Members serve a fixed term of two years and are eligible for re-appointment. They must be persons of ability, integrity and standing, with special knowledge of, or professional experience in, data governance, administration, law, dispute resolution, information technology, digital economy, cyber and privacy laws, or related fields.
The Chairperson may be full-time or part-time. Members are typically part-time.
03What the Board can do
Open inquiries
On its own motion, or on receipt of a complaint from a Data Principal, or on a reference from the Central Government or any court.
Summon and examine
Powers of a civil court under the Code of Civil Procedure to summon witnesses, take evidence on oath, and require production of records.
Impose penalties
Up to Rs. 250 crore per breach under the caps set by the Schedule. See penalty schedule.
Issue directions
Direct any Data Fiduciary or intermediary to take specific steps, block content, or cease processing. Non-compliance is itself a further breach.
04The appeal route
Board orders are appealable to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Section 29 of the Act, read with Rule 21 of the DPDP Rules 2025, routes appeals from the Board to TDSAT. Appeals must be filed within 60 days of the Board's order. TDSAT then hears the matter, with a further appeal to the Supreme Court on questions of law.
This is a significant choice of forum. TDSAT already handles telecom and broadcast disputes and has settled procedures. Data governance now sits alongside spectrum and interconnect disputes on the same bench.
05Once the Chair is named, this is roughly the sequence to expect
None of this is on any published Government calendar. The order below is stitched together from MeitY policy papers, LiveLaw and MediaNama reporting, and what happened when analogous regulators were set up (SEBI, CCI, TDSAT). Treat as informed guesswork.
The first thing the Board will publish is its own rules of procedure under Rule 17: how complaints are accepted, how hearings run, how orders are published. That usually lands within 60 days of the Chair joining, though there is no statutory deadline.
Next comes the first tranche of Significant Data Fiduciary designations under Section 10. These are Central Government notifications, not Board orders, but the Board's inputs weigh heavily in practice. Most compliance commentary expects the first designations to hit large social media intermediaries and consumer credit information companies before anything else.
Somewhere in the same window, expect the first cross-border restriction notifications if any are issued. Again a Central Government call under Section 16, but timed to signal the Board is up and taking its brief seriously.
Substantive adjudication only really begins after the core Rules (3, 5 to 16, 22 and 23) take effect on 14 May 2027. That is when the Board can start ruling on consent, breach, retention and rights failures. Realistic timing for the first published order: second half of 2027.