/The Board
Data Protection Board of India
What the Data Protection Board of India is, when and how it was established (G.S.R. 844(E), 13 November 2025), its composition, powers, procedure, appeals to the TDSAT, and the current status of appointments, from official sources.
What the Board is#
The Data Protection Board of India is the adjudicating authority created by Chapter V of the Digital Personal Data Protection Act, 2023. Section 18 empowers the Central Government to establish it by notification as a body corporate; sections 19 to 26 govern its composition, appointments, terms, officers and proceedings; sections 27 and 28 set out its powers, functions and procedure; and Chapter VII (sections 29 to 32) provides for appeals and alternate dispute resolution. Read the chapter in full: Chapter V.
Establishment: 13 November 2025#
By G.S.R. 844(E) dated 13 November 2025, issued under sub-sections (1) and (3) of section 18, the Central Government established the Data Protection Board of India with effect from publication in the Official Gazette. The notification fixes the head office in the National Capital Region of India.
On the same day, G.S.R. 845(E), issued under sub-section (1) of section 19, notified that the Board shall consist of four members.
Composition and appointments#
Under section 19 the Board consists of a Chairperson and such number of other Members as the Central Government notifies (now fixed at four). Appointments are made by the Central Government in the manner prescribed by the Rules, and section 20 sets a two-year term with eligibility for re-appointment.
On 6 May 2026 the Ministry of Electronics and Information Technology issued a circular and a public advertisement inviting applications for one Chairperson and four Members, to prepare a panel for a Search-cum-Selection Committee. The circular describes the Board as a body corporate functioning as an independent adjudicatory authority, "digital-by-design", empowered to inquire into personal data breaches and non-compliance, issue directions and impose monetary penalties. It sets out the eligibility conditions (Indian citizenship, a bachelor's degree, at least five years of special knowledge or professional experience in fields such as data governance, consumer protection, dispute resolution, information technology, digital economy, law or regulation) and the tenure (not exceeding two years or the age of sixty-five, whichever is earlier).
Status. As of the latest official document mirrored on this wiki, the appointment process had been opened but no appointment of a Chairperson or Members had been notified in the Gazette. This page is regenerated daily; any appointment notification picked up from the official feeds will appear under Official updates and be added here.
Powers and functions#
Section 27 gives the Board the power, on receiving an intimation of a personal data breach, to direct urgent remedial or mitigation measures, inquire into the breach and impose penalty; on a complaint by a Data Principal, or a reference by the Central or a State Government, or on a court direction, to inquire into breaches of the Act and impose penalty; and to act on complaints about Consent Managers and on references about breaches of registration conditions. It may also direct any person to meet obligations imposed by the Act.
Section 28 makes the Board a digital office: receipt of complaints, allocation, hearing and pronouncement of decisions follow techno-legal measures, and the Board functions as far as practicable without the parties' physical presence. It has the powers of a civil court for summoning, evidence and documents, must act in accordance with natural justice, and may close proceedings or impose costs for frivolous complaints.
Penalties#
After an inquiry, the Board may impose the monetary penalties set out in the Schedule, up to two hundred and fifty crore rupees for a breach of the security-safeguards obligation, having regard to the factors in section 33(2). The Board may also accept a voluntary undertaking under section 32. Penalties go to the Consolidated Fund of India (section 34).
Appeals and alternate dispute resolution#
Any person aggrieved by an order or direction of the Board may appeal to the Telecom Disputes Settlement and Appellate Tribunal within sixty days (section 29); orders are executable as civil court decrees (section 30). Where the Board thinks a complaint may be resolved by mediation, it may direct the parties to attempt mediation (section 31).
The Rules on the Board#
The DPDP Rules, 2025 prescribe the manner of appointment and service conditions of the Chairperson and Members, the functioning of the Board as a digital office, and the procedure for meetings and authentication of orders. See the Act ↔ Rules map for the rules made under sections 19 to 26 and 28.