Government Sources Indicate Data Protection Board of India to be Formed Soon

The Centre is soon going to appoint the much-awaited Chairman and members of the Data Protection Board of India (DPBI), which has been pending for almost a year, according to government sources.

A senior government official at the Ministry of Electronics and Information Technology (MeitY) stated that the process is moving forward and the Board should be in place soon, though an exact timeline could not be committed to as the approval process is not entirely within MeitY's control.

The development follows an October 17 directive by the Kerala High Court, which instructed the Centre to make the Data Protection Board functional within eight weeks. The court order was issued while disposing of a public interest litigation regarding the compliance of passenger data handling at airports under the Digital Personal Data Protection (DPDP) Act, 2023, and the Digital Personal Data Protection Rules, 2025. When asked about meeting the deadline, the official noted that the court order provides more time to make the appointments.

MeitY had previously invited applications in May for one Chairperson and four Members to staff the DPBI, which is designed to handle complaints and violations related to personal data protection in India. The Ministry had indicated that the Board will function as a fully digital and paperless body. Its core responsibilities will include investigating data breaches, checking compliance with DPDP rules, and imposing financial penalties on companies that fail to follow the law.

Under the established criteria, the Chairperson must have experience equivalent to an Additional Secretary rank in the government of India. Members are required to have served at the level of Joint Secretary or possess equivalent senior experience in the corporate or academic sectors.

The timeline for implementation dictates that the DPDP Act will be enforced from May 13, 2027. However, consent managers are required to apply to the DPBI for registration beginning November 13, 2026. Because the Board has not yet been formed and detailed guidelines on the Consent Manager regime are pending, entities are currently deliberating their registration decisions, leaving them in a temporary limbo.

Consent managers function as registered, neutral intermediaries that enable individuals to give, manage, review, or withdraw consent for their personal data across multiple organisations through a single interface.

"The impending formation of the Data Protection Board is a crucial step for the regulatory framework in India. With consent managers required to register by late 2026 and the full implementation of the DPDP Act slated for 2027, businesses must closely monitor these appointments. Clear guidelines from the Board will be essential for startups and established enterprises alike to align their data processing practices and avoid potential penalties." — Dr. Shishir Gupta, Founder & CEO, StartupLanes