Data Protection Board of India
The DPDP Act's enforcement authority. One board, national jurisdiction, penalties up to ₹250 crore.
The Data Protection Board of India is the sole enforcement authority under DPDP Act Chapter V. It does three things:
- Investigates breaches.
- Hears complaints.
- Can impose penalties up to ₹250 crore.
The Board is established in law (DPDP Act s.18; G.S.R. 843(E)). As notified, it has a Chairperson and four Members, to be appointed through a Search-cum-Selection Committee (Government reply, Lok Sabha Unstarred Question 3960, 12 August 2026). The posts were advertised in Employment News on 6 June 2026. The reply does not report any appointment. We have found no appointment order since. Last checked 6 October 2026.
Official text — Lok Sabha Unstarred Question 3960, answered 12 August 2026 (Phase 1)
Is the Data Protection Board operational yet? →
In plain English: the Board exists in law, but the government's reply of 12 August 2026 does not report any appointment. MeitY first invited applications on 6 May 2026.
For current Board composition and procedure, consult qualified counsel and the DPDP Act Chapter V text below.
DPDP Act, 2023 — Chapter V (Sections 18-26)
Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).
Board appointment process — nominations invited, 6 May 2026
Notified — checked 2026-10-06. Opened the MeitY notice F. No. 2(1)/2026-Pers.I dated 6 May 2026.
Official text — MeitY notice of 6 May 2026, para 2 (posts advertised)
The notice lists posts to be filled. The government's Lok Sabha reply of 12 August 2026 says the Board, as notified, has a Chairperson and four Members. The Board is set up under DPDP Act s.18, brought into force by G.S.R. 843(E).
Notified — checked 2026-10-06. Opened the MeitY notice F. No. 2(1)/2026-Pers.I dated 6 May 2026.
Am I a Data Fiduciary?
Reading about DPDP obligations? Run the 2-minute self-check to see exactly what applies to your product.
Run it now