India AI RulebookIs the Data Protection Board of India operational yet?
Can the Board hear your complaint yet? Here is what we can confirm from primary sources.
Checked against primary sources where marked. Items marked Confirmation pending are not yet checked. See the list
Short answer
Current appointments could not be established by the limited official-index check on 1 November 2026.Ask the editor or your lawyer for the official source before relying on this. On 1 November 2026 we checked MeitY's What’s New index. Its notifications URL returned Page Not Found, and PIB did not return the requested October coverage. We cannot confirm current appointments. The earlier source record follows; its check date has not been advanced.
The Board is established in law (DPDP Act s.18; G.S.R. 843(E)). As notified, it has a Chairperson and four Members, to be appointed through a Search-cum-Selection Committee (Government reply, Lok Sabha Unstarred Question 3960, 12 August 2026). The posts were advertised in Employment News on 6 June 2026. The reply does not report any appointment. We have found no appointment order since. Last checked 6 October 2026.
The detail
"Constituted" and "operational" are different things. Sections 18–26 of the DPDP Act create the Data Protection Board and set its composition. These sections commenced on 13 November 2025 alongside the DPDP Rules 2025. That gave the Board a legal existence. It also gave the government the machinery to appoint a Chairperson and Members.
Official text — Lok Sabha Unstarred Question 3960, answered 12 August 2026 (Phase 1)
The reply says nothing about Consent Manager registrations, breach reports or complaint numbers, so we give no numbers.
The complaint route is also not live. Under the Act, a Data Principal must first go to the Data Fiduciary's own grievance-redressal process. Only then can she approach the Board. That second step has nowhere to go yet. The Board's power to inquire into complaints (Section 27) starts on the main-duty planning date (G.S.R. 843(E)(c)).
The duties a complaint would be about include notice, consent, security, breach reporting, and rights. None of these are enforceable until 13 May 2027. That is also when section 33 and the Schedule of penalties take effect.
Where the Board sits in the timeline
Sections 2 and 18–26 started, with Sections 35, 38–43, 44(1) and 44(3) (G.S.R. 843(E)(a)). Rules 1, 2 and 17–21 started too (Rule 1(2)). The Board exists in law. We have not confirmed any member appointments.
Section 6(9), section 27(1)(d) and Rule 4 commence. Whether registration will be available in practice on that date remains unconfirmed.
Notice, consent, security, breach reporting, retention, children's data, Significant Data Fiduciary duties, rights, cross-border transfers and section 33 penalties all take effect — the point from which the Board can adjudicate and fine.
What this means for you
No regulator is knocking today, but your own grievance-redressal process must exist and work by 13 May 2027 — it is the first step every complaint runs through.
Clients asking you to prove "Board compliance" are asking for something that does not exist yet; build to the Act's duties instead.
If a platform mishandles your data now, the DPDP complaint route is not available — existing IT Act and consumer channels are what you have.
Status
Read next
Primary sources
Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023) — sections 18–26 establish the Board.
We opened this on 2026-11-01
Board appointment process — nominations invited from Ministries, Departments and States, 6 May 2026.
Verified — 2026-10-06
Notified — checked 2026-10-06. Opened the MeitY notice F. No. 2(1)/2026-Pers.I dated 6 May 2026.
G.S.R. 846(E), 13 November 2025 — sets the phased commencement dates; Rule 4 (Consent Manager registration provisions) commences the Consent Manager planning date. The Gazette issue is dated 13 November 2025. The e-Gazette file ID (CG-DL-E-14112025-267650) carries 14 November. Some sources count from the 14th. We plan for the earlier date. Operational availability is unconfirmed.
We opened this on 2026-11-01
Companion notifications issued the same day (13 November 2025)
- G.S.R. 843(E), 13 November 2025 — Phased commencement of the DPDP Act's sections.
- G.S.R. 844(E), 13 November 2025 — Board-related notification. Cited by number only; not opened.
- G.S.R. 845(E), 13 November 2025 — Board-related notification. Cited by number only; not opened.
Cited by number and date only. We do not link them, and we do not rely on 844(E) or 845(E) for the Board's make-up. For that we cite the Lok Sabha reply of 12 August 2026.
Citation
Kokate, S. (2026). Is the Data Protection Board of India operational yet? India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/is-the-data-protection-board-operational. Educational content, not legal advice.