Glossary
What is the Data Protection Board under DPDP?
The Data Protection Board of India is the body the DPDP Act sets up to oversee it. Its set-up rules are in force, but it has no members yet.
Definition
The Data Protection Board of India is the Board established under s.18 of the DPDP Act, 2023. It receives breach intimations, registers Consent Managers, can be approached by Data Principals after grievance redressal, and decides penalties after an inquiry (s.33). As of 4 November 2026, no Chairperson or Members have been appointed.
What it means
Rules 17 to 21 of the DPDP Rules, 2025 cover the Board's appointment, service, meetings, digital office and staff, and have been in force since 13 November 2025. MeitY advertised the posts in 2026.
As of 4 November 2026, no Chairperson or Members have been appointed, so there are no Board orders or penalties to point to. Treat any claim of a DPDP fine with care. See the DPDP timeline.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.18 | Establishes the Board |
| s.6(9), Rule 4 | Registers Consent Managers; can suspend or cancel after a hearing |
| s.8(6), Rule 7 | Receives breach intimation and the detailed report within 72 hours |
| s.13(3) | Data Principals approach it after exhausting grievance redressal |
| s.33 | Decides penalties after an inquiry |
| s.29, Rule 22 | Appeals go to the Appellate Tribunal (TDSAT) |
| Rules 17 to 21 | Appointment, service, meetings, digital office and staff |
Common misconceptions
- “The Board is already hearing cases.” No members have been appointed yet.
- “Breach intimation can wait until the Board is staffed.” Rule 7 begins on 13 May 2027 with the other core obligations; plan the process now.
- “The DPO reports to this Board.” An SDF's DPO is responsible to the SDF's own Board of Directors or similar governing body (s.10(2)(a)).
Related terms
The fiduciary's complaint process, used before the Board (s.13).
Consent ManagerA Board-registered single point of contact for managing consent (s.2, Rule 4).
Data Protection OfficerThe India-based officer a Significant Data Fiduciary appoints (s.10(2)(a)).
Significant Data FiduciaryA Data Fiduciary the Central Government notifies for extra duties (s.10).
In TruePrivacy
Breach management runs a clock for each audience: the Board “without delay” (TruePrivacy uses a 24-hour working target), the Board's detailed report within 72 hours, and each affected Data Principal without delay. The audit trail logs every action with before and after values and exports as CSV.
Has the Data Protection Board been set up?
It is established under s.18, and Rules 17 to 21 on its set-up have been in force since 13 November 2025. As of 4 November 2026, no Chairperson or Members have been appointed.
Has the Board imposed any DPDP penalty?
No. With no members appointed, there are no Board orders or penalties yet.
Where do appeals against the Board go?
To the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal (s.29, Rule 22).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin