Data Protection Board of India

The Data Protection Board of India (DPBI, often just the Board) is the regulator for the DPDP Act, constituted under Sections 18 to 26 of the Act. Section 28 designs the Board to operate primarily as a digital office — proceedings and inquiries conducted electronically. The Board's powers include inquiring into breaches of the Act, imposing penalties on Data Fiduciaries, and giving directions for compliance. Appeals from Board orders go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) under Section 29.

Status at 1 November 2026: the Board exists in law from the Rules' commencement date of 13 November 2025, but no Chairperson or members have been appointed (Lok Sabha reply of 12 August 2026; RTI reply reported by The Economic Times in October 2026). The Board had an operational budget of nil in its first year. The Board can only adjudicate matters once it has members and procedural regulations under Section 28(2); until then, no penalty can be imposed and no inquiry can be opened. Chapter VIII penalties, Section 10 SDF duties and all Data Principal rights commence on 13 May 2027 — adjudication is expected to begin after both the Board is staffed and the substantive duties are in force.