Data protection board stalled as Centre delays notification of selection panels

The Central government has yet to notify the selection committees responsible for constituting India’s Data Protection Board, leaving one of the country’s most consequential regulatory bodies in a state of limbo even as the digital economy it is meant to oversee continues to expand rapidly.

The Data Protection Board of India, established under the Digital Personal Data Protection Act of 2023, was envisioned as the primary adjudicatory body for handling complaints, imposing penalties, and enforcing compliance with India’s data protection framework. Its operationalisation has been widely awaited by industry, civil society, and legal practitioners alike. Yet the failure to notify the selection panels — the foundational step in appointing its members — means the Board remains non-functional, with no clear timeline for when it will begin its work.

The delay is significant for several reasons. Businesses operating in India have been seeking regulatory clarity on how the DPDP Act will be enforced in practice, and the absence of an operational Board has left that question unanswered. Data fiduciaries — the term the Act uses for entities that process personal data — have been unable to gauge enforcement priorities, penalty thresholds in practice, or how the Board will interpret key provisions of the law.

For citizens, the delay means that the grievance redressal mechanism the Act promised remains unavailable, and complaints about data misuse or breaches have no designated forum for adjudication.

The government has faced criticism for the pace at which the DPDP Act’s implementation architecture is being put in place, with rules under the Act also yet to be finalised. Together, the missing rules and the non-functional Board have left India’s data protection regime largely on paper more than two years after the legislation was passed.