"A law is only as effective as the institution that enforces it." Examine this in the context of the Data Protection Board under the DPDP Act, 2023.

The DPDP Act, 2023 gives citizens rights over their personal data. The Data Protection Board of India (DPBI), set up under Section 18, is the body that turns those rights into remedies [3]. In October 2026, the Kerala High Court heard a PIL on Digi Yatra and directed the Centre to make the Board functional within eight weeks [1]. That order shows the statement largely holds, though the Board's power also depends on how the law itself is drafted.

Why the Act depends on the Board

• Sole adjudicator: The Board inquires into breaches, issues directions and imposes penalties [3]. Without a working Board, citizens whose data is misused have no complaint forum under the Act.
• Deterrence only works if someone enforces it: Penalties go up to ₹250 crore for security failures and ₹200 crore for children's-data violations [2]. They deter only if someone hears cases and imposes them.
• Paper vs practice: The Rules were notified in November 2025 with an 18-month phased compliance period [2]. The Board was reportedly established [3]. Even so, the court found that air travellers' privacy was being compromised [1].

Gaps in the institution itself

• Short tenure: Members serve two years with reappointment, against five years for SEBI and CCI [4]. In Rojer Mathew (2019), the Supreme Court warned that this pattern increases executive control [4].
• Selection: The Board's composition is set through Rules, not written into the Act. The 2018 draft Bill had a selection panel led by the Chief Justice of India [5].
• Capacity: A "digital-by-design" office [3] needs staff and technology. An 8-week deadline risks a weak start.

Limits the Board cannot overcome

• State exemptions: The Centre can exempt its own agencies from any or all provisions of the Act [4].
• No compensation: The Act does not regulate harm to individuals, unlike GDPR Article 82 [4]. Fines go to the state, not to the person harmed.

Way forward

• Write a five-year, non-renewable tenure and a judge-led selection panel into the Act itself.
• Apply the PUCL tests of necessity, purpose limitation and storage limitation to exempted processing [4].
• Fund the Board adequately and add a compensation route for victims.

Without the Data Protection Board, the DPDP Act's rights cannot be enforced, so the statement largely holds. But the Board can only be as strong as the law that designs it. An independent, well-resourced Board and narrower exemptions would give real effect to the Puttaswamy (2017) right to privacy under Article 21 and build trust in India's digital economy.