Data Protection Board of India in 2026: Established, Recruiting, Not Yet Enforcing

The Data Protection Board of India is the body that will investigate personal data breaches and complaints and impose penalties of up to ₹250 crore under the DPDP Act. On paper it has existed since 13 November 2025. In practice, as of mid-October 2026, it is still being staffed.

Where things stand

• Established: The Board was constituted by notification (G.S.R. 844(E)) on 13 November 2025, with a Chairperson and four Members provided for. Sections 18–26 of the Act and Rules 17–21, which govern its composition and functioning, are in force.
• Recruiting: On 6 May 2026, MeitY issued a circular (F. No. 2(1)/2026-Pers.I) inviting applications for one Chairperson and four Members. Candidates need expertise in fields such as data governance, law, the digital economy, ICT, regulation, dispute resolution or consumer protection. Appointments are made on the recommendation of a search-cum-selection committee under the Rules, for a term of up to two years.
• Not yet appointed: As of early October 2026, trackers that monitor official channels report no notification appointing a Chairperson or Member.

Can the Board act today?

Very little, for two reasons:

1. No Members, no quorum. The Board acts through its Chairperson and Members, and without appointments it cannot hold proceedings.
2. Nothing to enforce yet. The obligations of Data Fiduciaries (Sections 4–10) and the penalty provision (Section 33) only commence around May 2027. Until then there is no breach of the Act for the Board to penalise.

What the Board will do once staffed

• Register Consent Managers from 13 November 2026, which is its first operational job.
• Receive breach intimations and direct urgent remedial measures.
• Inquire into complaints from Data Principals, references from government and court directions.
• Impose penalties under the Schedule after an inquiry, weighing the nature, gravity and duration of the breach, its repetitive nature, any gain or loss, and the mitigation undertaken.
• Accept voluntary undertakings (Section 32), which is an important settlement route.
• Operate as a digital office: the Rules require the Board to function techno-legally, including filings and hearings conducted online.

Appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Why the delay matters to you

Board independence is one of the issues raised in the Supreme Court challenge, and a slow start does not move the May 2027 date. When the Board is staffed it will inherit a backlog: Consent Manager applications first, then the first wave of breach intimations and complaints. Organisations with clean, timestamped evidence will be in the strongest position in those first proceedings.

Saakshi, Data Adhikaar's audit agent, keeps that evidence trail (notices, consents, rights requests, breach decisions) audit-ready in the Vault. Start with the readiness assessment, and see what is at stake in DPDPA penalties explained.

Position as of 15 October 2026. Not legal advice.