Evaluate the institutional design of the Data Protection Board of India with respect to independence, capacity and accountability.

The Data Protection Board of India (DPBI) was set up under the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) [1]. It is the body that must turn the Puttaswamy (2017) right to privacy into remedies people can enforce. Its design is modern on capacity and procedure but weak on independence.

Independence

• (+) Its decisions can be appealed to TDSAT, an existing tribunal, which gives an outside check [2].
• (–) Set up by the executive: the Central Government constitutes the Board and appoints its members [3].
• (–) Short tenure with eligibility for re-appointment: PRS warns this may affect the Board's independent functioning [3]. A member who hopes for a second term may avoid ruling against the government.
• (–) Conflict of interest: government departments are among the biggest Data Fiduciaries. Wide State exemptions, such as national security, also put much State data use outside the Board's reach [3].

Capacity

• (+) Fully digital by design: complaints can be filed, tracked and heard online [2].
• (+) Phased rollout: the Board came first (Nov 2025), then Consent Manager registration (13 Nov 2026), then inquiries and penalties (13 May 2027) [2][4]. The institution exists before enforcement starts.
• (–) Only four members [2]. They must assess every Consent Manager application and keep the public registry [4]. From May 2027 the same members also handle nationwide inquiries and penalties, so a bottleneck is likely.

Accountability

• (+) Transparency: the Board publishes the list of registered Consent Managers on its website [4].
• (+) Citizen-facing duty: Consent Managers are accountable to the Data Principal, and the Board oversees them [4].
• (–) An appeal only corrects a decision after it is made. It cannot force a cautious Board to open an inquiry.
• (–) Enforcement gap: penalty powers start only in May 2027 [4]. Until then, a registered Consent Manager that fails its users cannot be penalised.

Verdict and Way Forward

Overall, the DPBI scores well on digital capacity and step-by-step rollout, moderately on accountability, and poorly on independence. Several changes would strengthen it: a longer fixed tenure without re-appointment, selection by an independent panel, more members and technical staff, and a common consent standard published before penalties begin. These would make the Board an impartial guardian of informational privacy, in line with Article 21 and SDG 16's call for accountable institutions.