Data Protection Board of India

Topic: Transparency, Accountability and e-Governance · NCERT: Beyond NCERT

Meaning

The Data Protection Board of India is a body set up by the Union government under section 18 of the Digital Personal Data Protection (DPDP) Act 2023. It looks into personal data breaches, hears people's complaints, orders urgent steps after a breach and fines those who break the Act [3][2].

• It is the main body that enforces India's first data protection law. This law protects the right to privacy, which the Supreme Court declared a fundamental right under Article 21 in K.S. Puttaswamy v Union of India (2017).
• It matters for exams and for Mains debates because the Board's independence from the government is widely questioned.

Explanation

What the Board does

• Inquires into breaches. A personal data breach is when personal data is leaked, lost or misused. The Board checks whether a data fiduciary broke the Act [2]. A data fiduciary is the company or body that decides why and how personal data is used [1].
• Directs urgent steps. After a breach, it can order the fiduciary to act at once to limit the harm [2].
• Hears complaints. It takes up complaints from data principals, meaning the people the data is about [2].
• Imposes penalties. It can fine fiduciaries up to the limits set in the Schedule of the Act (s.33) [3].
• Registers consent managers. A consent manager is a body registered with the Board that runs one simple platform. On it, a person can give, review or withdraw consent across many apps [1][3].
• Receives breach reports. Fiduciaries must report every breach to the Board and to each affected person (s.8(6)) [2]. Under the Rules, a detailed report must reach the Board within 72 hours [1].

Composition and working

• Members: a Chairperson plus "such number of other Members" as the Centre notifies (s.19). At least one member must be a legal expert [3].

• The DPDP Rules 2025 fix the Board at four members [1].

• Term: 2 years. Members can be reappointed (s.20) [3].

• Digital office: people file and track complaints online, through a portal and a mobile app [1].
• Start date: the Rules were notified on 14 November 2025. The parts on setting up and running the Board came into force at once [1]. Most duties of fiduciaries start only after 18 months (about May 2027) [1].

How a complaint moves (in order)

1. Fiduciary first: the person must first complain to the data fiduciary or consent manager (s.13) [3].
2. Then the Board: if the problem is not fixed, the person goes to the Board. The Board holds an inquiry and may impose a penalty (s.33) [3].
3. Appeal to TDSAT: an appeal against the Board's order goes to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (s.29) [3].
4. Supreme Court: a further appeal lies to the Supreme Court.

Special powers and limits

• Voluntary undertaking (s.32): a fiduciary may give the Board a written promise to fix a problem. If it breaks that promise, it pays the same penalty as the original breach [3].
• Blocking (s.37): if the Board has penalised a fiduciary two or more times, it can recommend that the platform be blocked. The Centre, not the Board, then decides. It can order a block "in the interests of the general public" after giving the fiduciary a hearing [3].
• Information (s.36): the Centre may ask the Board for information [3].
• Penalties go to the government: all fines go to the Consolidated Fund of India (the main account of the Union government). Victims get none of this money [3].

Maximum penalties the Board can impose (s.33(1)) [3][1]

Breach	Maximum penalty
No reasonable security safeguards (s.8(5))	₹250 crore
Not reporting a breach to the Board or affected persons (s.8(6))	₹200 crore
Breaking duties towards children (s.9)	₹200 crore
Breaking extra duties of a significant data fiduciary (s.10)	₹150 crore
Breaking a voluntary undertaking (s.32)	Same as the original breach
Any other breach	₹50 crore
Data principal breaking own duties (s.15)	₹10,000

In the Constitution and practice

• Constitutional base: the Board is not a constitutional body. It is a statutory body, created by the DPDP Act 2023 (Act No. 22 of 2023). The Act got the President's assent on 11 August 2023 [1][3]. The law gives effect to the right to privacy under Article 21, as held in Puttaswamy (2017).
• How the idea changed:
• The Justice B.N. Srikrishna Committee (report 2018) proposed a strong Data Protection Authority.
• The PDP Bill 2019 went to a Joint Parliamentary Committee, which reported in December 2021. The government withdrew that Bill in August 2022.

• The 2023 Act replaced the Authority with a smaller, Centre-appointed Board.

• Who controls it: the Union government appoints the members, sets the Board's size and provides its staff and support [2].

• Rules and phase-in: draft Rules came out in January 2025 and drew 6,915 inputs [1]. The final Rules were notified on 14 November 2025, so the Board is the first part of the Act to start working [1].
• Link with the State's power to exempt: under s.17(2)(a), the Centre can exempt any notified government agency from the whole Act [3]. The Board then has no power over that agency.

Don't confuse with

• Data Protection Authority (Srikrishna Committee, 2018): this was a proposed independent regulator with wide powers. The Board that actually exists is set up and serviced by the executive, with a 2-year term [2].
• TDSAT: the Board decides complaints first. TDSAT hears appeals against the Board's orders, within 60 days (s.29) [3]. Appeals do not go to a High Court.
• Central Information Commission (RTI Act 2005): the CIC enforces the right to get government information. The Board enforces the right to protect personal data. The DPDP Act also amended s.8(1)(j) of the RTI Act through s.44(3), which widened the RTI exemption for personal information [3].
• Consent manager: a consent manager is a private body (under the Rules, an India-based company) that helps people manage consent [1]. It is registered with the Board. It is not part of the Board and has no power to fine.

Prelims Hooks

• Board set up under s.18 of the DPDP Act 2023. Members serve 2 years and can be reappointed (s.20). The Rules fix four members [3][1].
• Appeal from the Board goes to TDSAT within 60 days (s.29), not to a High Court [3].
• Highest penalty = ₹250 crore for not keeping security safeguards. Breaking children's duties is ₹200 crore, not ₹250 crore [3].
• Trap: the Board cannot block a platform by itself. It only recommends after two or more penalties; the Centre orders the block (s.37) [3].
• Penalty money goes to the Consolidated Fund of India, not to victims [3].
• The Board is a statutory, digital-first body. Complaints are filed online through a portal and app [1].

Mains Points

• Independence of the regulator:
• The Centre appoints the members, sets the Board's size and services it. Members also get only 2-year renewable terms, while comparable regulators get 5 years [2].
• But the State is itself the largest holder of personal data. A Board controlled by the executive may not hold the government to account.

• Reform: an independent selection panel, 5-year terms and financial autonomy, as the Srikrishna Committee wanted.

• Remedies for victims:

• The Board can impose fines of up to ₹250 crore, but all of it goes to the Consolidated Fund. Victims get no compensation [2][3].

• Reform: allow victims to claim compensation, as the EU GDPR does.

• Limited reach over the State:

• Under s.17(2)(a), the Centre can take its own agencies wholly outside the Act, and so outside the Board's power. There is no proportionality check (the Puttaswamy test that any limit on privacy must be no more than needed) [2][3].
• Reform: require a written, time-limited order for each exemption, reviewed by a judicial or parliamentary body.

Related concepts

• Justice B.N. Srikrishna Committee
• Digital Personal Data Protection Act 2023
• Data fiduciary
• Data principal
• Consent manager
• DPDP Rules 2025

Read more

• Data protection: the DPDP Act 2023 and Rules 2025