Data Protection Board to be in place ‘pretty soon’: Government Sources

MeitY in May this year had invited applications for one Chairperson and four Members for the DPBI that will handle complaints and violations related to personal data protection in India | Photo Credit: REUTERS

The Centre is soon going to appoint the much-awaited Chairman and members of the Data Protection Board of India (DPBI), which is pending for almost a year now, sources told businessline.

“The process is moving forward...Pretty soon, we should have the Board in place. But, can’t commit on the exact timeline. The process of approval is not entirely in MeitY’s control,” a senior government official at the Ministry of Electronics and Information Technology (MeitY), told businessline.

On October 17, the Kerala High Court had also directed the Centre to make the Data Protection Board, constituted under the Digital Personal Data Protection (DPDP) Act, 2023, functional within eight weeks.

Application for Board

Asked whether the government would be able to meet the deadline, the official said that the order gives “more time” to the government to appoint the Board members.

The Kerala High Court had issued the directive while disposing of a public interest litigation which sought to ensure that collection, storage, processing and transmission of sensitive personal data of passengers at airports across India is conducted in strict compliance with the provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

MeitY in May this year had invited applications for one Chairperson and four Members for the DPBI that will handle complaints and violations related to personal data protection in India.

The Board will work as a fully digital and paperless body, MeitY had informed adding that the key responsibilities would include investigating data breaches, checking compliance with DPDP rules, and imposing financial penalties on companies that fail to follow the law.

Qualification

As per the conditions laid out, the Chairperson should have experience equivalent to an Additional Secretary rank in the government of India and the Members should have worked at the level of Joint Secretary or have similar senior experience in the corporate or academic sectors.

The DPDP Act is going to be implemented from May 13, 2027, but before that consent managers have to apply to the DPBI for registration from November 13, 2026.

Therefore, without the formation of the DPBI and the Board’s detailed guidelines on the Consent Manager regime, entities are still deliberating whether they would register and their decision is in a limbo.

Consent managers are essentially registered, neutral intermediaries that allow individuals to give, manage, review, or withdraw consent for their personal data across multiple organisations from a single interface.

Published on October 30, 2026