The Ministry of Electronics and Information Technology (MeitY) on May 6, 2026, issued a recruitment notification inviting applications for the posts of Chairperson and four Members of the Data Protection Board of India (DPBI) — the independent adjudicatory authority mandated under the Digital Personal Data Protection Act, 2023 (DPDP Act). Applications are to be submitted within 30 days of publication in the Employment News and must reach the Deputy Secretary (Personnel) at MeitY. The Board's constitution marks the critical governance milestone between the November 2025 notification of DPDP Rules and the commencement of active enforcement of India's data protection framework.
Background
The Digital Personal Data Protection Act, 2023 received Presidential assent on August 11, 2023 and established a comprehensive legal framework governing the collection, processing, and storage of digital personal data of Indian citizens. The Act defines obligations for Data Fiduciaries (entities processing personal data), rights of Data Principals (individuals whose data is processed), and establishes the Data Protection Board of India as the primary enforcement and adjudicatory authority.
The DPDP Rules, 2025 were notified on November 14, 2025, following a national consultation process in which MeitY received 6,915 inputs from startups, MSMEs, industry bodies, civil society organisations, government departments, and citizens across seven cities. The Rules operationalise the Act's provisions on consent, data principal rights, breach notification, children's data obligations, and the Board's functioning.
Under the DPDP Rules 2025, the Board functions as a fully digital institution: Data Principals may file complaints and track their status online through a dedicated platform and mobile application. The 18-month phased compliance period under the Rules began upon notification in November 2025. The constitution of the Board is a prerequisite for active enforcement — without a constituted Board, penalty proceedings cannot be initiated.
Key Provisions
Board Composition: The Data Protection Board of India consists of a Chairperson and four other Members, appointed by the Central Government. The notification specifies that detailed eligibility criteria are available at www.meity.gov.in.
Role and Functions: Under the DPDP Act, the Board:
- Investigates complaints filed by Data Principals regarding violations of the Act or Rules by Data Fiduciaries.
- Investigates personal data breach reports submitted by Data Fiduciaries under the Act's mandatory breach notification obligation.
- Directs remediation measures where a breach or violation is established.
- Imposes financial penalties on Data Fiduciaries and Data Processors found to have violated the Act or Rules.
- Functions as a fully digital adjudicatory body — proceedings, filings, and orders are digital-first.
Appellate Forum: Orders of the Data Protection Board are appealable to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which acts as the statutory appellate authority under the DPDP Act.
Penalty Framework: The Act prescribes tiered penalties:
- Failure to maintain reasonable security safeguards resulting in a data breach: up to Rs 250 crore.
- Failure to notify the Board or affected Data Principals of a personal data breach: up to Rs 200 crore.
- Violations of obligations relating to children's data (including profiling children or tracking their behaviour): up to Rs 200 crore.
- Any other violation of the DPDP Act or DPDP Rules 2025: up to Rs 50 crore per violation.
Compliance Timeline: The 18-month phased compliance window, which began in November 2025, continues. Organisations have until approximately May 2027 to complete full system alignment, though the Board's constitution may accelerate scrutiny once enforcement becomes operational.
Implications for Practitioners
For legal and compliance teams in data-processing organisations: The recruitment of Board leadership signals that enforcement is now on an active timeline, not indefinitely deferred. Organisations that have been deferring consent architecture, privacy notice updates, and data principal rights infrastructure on the assumption of slow regulatory build-up should accelerate implementation. The 18-month window from November 2025 closes around May 2027 — but the Board can begin processing complaints immediately upon constitution.
For technology companies processing children's data: The Rs 200 crore penalty tier for children's data violations applies independently of whether a breach occurred. Any platform accessible to children — defined under the DPDP Act as individuals below 18 years — must implement verifiable age-gating and parental consent mechanisms. This includes apps, websites, and digital services. The Board's first enforcement actions are likely to target high-visibility violations in sectors with significant child user bases.
For consent managers and data intermediaries: The DPDP Rules create a role for "Consent Managers" — technology platforms that help Data Principals manage their consents across multiple Data Fiduciaries. The Board will have jurisdiction over Consent Manager operations as well. Entities positioning themselves as Consent Managers should review the eligibility and obligations framework in the Rules ahead of Board operationalisation.
For TDSAT litigation practitioners: TDSAT's jurisdiction has been significantly expanded by the DPDP Act's designation of it as the appellate forum for Board orders. Counsel advising clients on potential Board-issued penalty orders should now map TDSAT procedural rules and filing requirements into their response strategies from the outset.
Timeline outlook: Board constitution (May 2026 recruitment) → appointment and operationalisation (likely Q3 2026) → initial complaint intake and enforcement proceedings (likely Q4 2026–Q1 2027) → first substantive penalty orders (estimated 2027). Organisations should treat this as an active compliance window, not a grace period.
Frequently Asked Questions
Q: What is the Data Protection Board of India and what powers does it have? A: The Data Protection Board of India is an independent adjudicatory authority under the DPDP Act, 2023. It investigates data breaches, hears complaints from Data Principals, directs remediation, and imposes penalties of up to Rs 250 crore for security safeguard failures. Appeals against its orders lie with TDSAT.
Q: What is the 18-month phased compliance timeline under the DPDP Rules 2025? A: The DPDP Rules 2025, notified November 14, 2025, provide an 18-month window (until approximately May 2027) for Data Fiduciaries to build consent frameworks, rights-management mechanisms, breach notification systems, and children's data safeguards before full enforcement applies.
Q: What penalties can the Data Protection Board impose for DPDP Act violations? A: Key penalty tiers: up to Rs 250 crore for security safeguard failures leading to a data breach; up to Rs 200 crore for failure to notify the Board or individuals of a breach or for children's data violations; up to Rs 50 crore for any other Act or Rules violation.
Sources: MeitY recruitment notification dated May 6, 2026 (meity.gov.in); PIB press release on DPDP Rules 2025 notification (pib.gov.in, PRID 2190655); MeitY DPDP Rules 2025 official document (meity.gov.in). This article reports facts drawn from official government sources. Veritect Legal Intelligence analysis is original. This article is for informational purposes and does not constitute legal advice.