India’s data privacy framework could move closer to full implementation when the government prepares to appoint the leadership of the Data Protection Board of India. Cabinet may clear five key posts for the statutory body, including one chairperson and four members.
The appointments are significant because the Board is intended to serve as the country’s key adjudicatory authority for enforcing provisions of the Digital Personal Data Protection Act, 2023. The Ministry of Electronics and Information Technology had invited applications for the posts earlier this year.
The Data Protection Board was created under Section 18 of the DPDP Act (MeitY). The responsibilities of the Data Protection Board are to police the breaches and non-compliance of personal data and issue directions for mitigation and remediation and to impose monetary penalties under the law and applicable rules.
Five Posts Up For Appointment
The government has been seeking one chairperson and four members of the Data Protection Board. The recruitment notice issued by MeitY in May 2026 said applicants are required to be Indian citizens and hold at least a bachelor's degree from a recognised university.
Candidates are also required to have at least five years of special knowledge or professional experience in areas such as data governance, administration, law, regulation, dispute resolution, information and communication technology, the digital economy or social and consumer protection.
The Board is intended to be a digital-first institution. Its duty is to examine personal data protection issues and ensure compliance with the policy framework laid down in the DPDP Act and Rules.
As of August 2026, the Board did not yet have an appointed chairperson or members, as per India Data Law's tracking of the implementation process. The recruitment advertisement for the five posts was published in June.
Why Data Protection Board Matters?
India's Digital Personal Data Protection Act was enacted in August 2023. It will help in creating a framework for organisations to understand how they collect, process and protect digital personal data and is a vision for digital personal data collection, processing and treatment.
The government notified the DPDP Rules in November 2025. The Act and Rules also set out a set of obligations for organisations handling personal data as well as individuals' rights to be able to use their information.
The framework includes Data Fiduciaries that decide the purpose and way to process personal data. Data Principals are persons whose data is being processed.
The law is based on principles such as consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability.
The Board is expected to be at the vanguard of this system because it will be responsible for enforcement under the Act. Such acts are subject to heavy financial penalties for breaches of reasonable security safeguards and personal data breaches.
Implementation Is Being Phased
The DPDP Act and Rules have been notified, but not all provisions are in place at the same time. The government has taken a phased approach and organisations have time to prepare their systems and compliance processes.
As per implementation tracking by India Data Law, Sections 18 to 26 for the establishment and composition of the Board came into force in November 2025. However, provisions giving the Board its adjudicatory powers and imposing some penalties are to be implemented later.
Sections 27 and 28, along with provisions for penalties and adjudication, will take effect in May 2027, according to the same tracking. That is, the Board's selection is an important institutional step, but the entire enforcement mechanism does not become operational immediately.
The Board’s ultimate functioning will be closely watched by businesses, technology companies and digital platforms that deal with large amounts of personal information. And a framework that aims to better enable people’s information collection and use will give them much more transparency and rights over their information.
The proposed appointment of a chairperson and four members would, therefore, give the Data Protection Board the leadership structure under India's data privacy framework. The next major milestones will be the formal appointments and the implementation of the provisions that give the Board full enforcement powers.
