#India's Data Protection Board Still Has No Leadership — And the Compliance Clock Is Running Anyway

Correction (1 November 2026). The original version of this post, published on 30 June 2026 under the headline "India's Data Protection Board Finally Has Leadership", said that MeitY appointed the Chairperson and Members of the Data Protection Board of India on 6 June 2026. That was wrong. On 6 June 2026 MeitY issued a further notice in its call for applications for those posts; it did not appoint anyone. As of 1 November 2026 no Chairperson or Member has been appointed, and on 7 October 2026 the Union government told the Kerala High Court that the Board "has been constituted but is not yet functional". We have rewritten the post to reflect the public record, and corrected the same claim where it was repeated in our other articles. We apologise to readers who relied on it.

The Data Protection Board of India (DPBI) is the independent adjudicatory authority that will investigate breaches, hear complaints and impose penalties of up to ₹250 crore under the Digital Personal Data Protection Act, 2023. It exists in law. It does not yet exist in practice: it has no Chairperson, no Members, and no published process for receiving the filings that the Act and Rules route to it. The compliance deadlines, however, have not moved.

---

#Established in Law, Absent in Fact

The DPDP Act received presidential assent in August 2023. The Digital Personal Data Protection Rules, 2025 were notified on November 13, 2025, and the Board's establishing provisions came into force that day. Since then the Board has existed on paper only.

Under Rule 17 of the DPDP Rules, a Search-cum-Selection Committee chaired by the Cabinet Secretary — joined by the Law Secretary, the IT Secretary and two domain experts — recommends candidates for Chairperson and Member to the Central Government. MeitY invited applications for those posts by notice dated 6 May 2026, and issued a further notice on 6 June 2026. Neither produced an appointment. As LiveLaw put it in August, the Board was "established in law, absent in fact", with no appointed Chairperson and no appointed Members.

That is still the position. On 7 October 2026, in C.R. Neelakandan v. Union of India, a public-interest petition about Digi Yatra passenger data, Union counsel told the Kerala High Court that the Board "has been constituted but is not yet functional". The Division Bench directed that it be made functional within eight weeks — roughly by early December 2026 (LiveLaw, Bar & Bench). Independent trackers checked at the end of October still list no appointments (indiadatalaw.org). Reports that appointments are imminent are, so far, unsourced.

---

#Why This Matters: The Deadlines Do Not Wait for the Board

The DPDP Rules establish a phased implementation timeline, and none of it is conditional on the Board being staffed.

By November 13, 2026, Rule 4 — the Consent Manager framework — commences. The Board is the registration authority for Consent Managers, so on day one there will be no one to register them with; but the obligations that flow from the framework are in force regardless.

By May 13, 2027, the remaining obligations of Data Fiduciaries take effect. Penalties up to ₹250 crore for security failures, ₹200 crore for breach notification failures, and ₹50 crore for other violations are imposed per contravention — by the Board, once it exists.

A Board that has not yet been staffed will need to hire, build processes and set up its enforcement infrastructure at the same time as these obligations arrive. For businesses, the practical risk is not that the Board is absent forever. It is that when it is seated, it inherits obligations that have been in force for months, and a backlog of complaints and breach intimations about them.

---

#The Compliance Gap Is Alarming

Here is the uncomfortable reality for corporate India: as of mid-2026, the vast majority of organizations are not DPDP-ready.

A May 2026 reality check analysis found:

• ~70% of organizations struggle to correctly interpret the DPDP Act and Rules
• 80% have not updated their privacy policies or data governance frameworks
• Only 40–50% of companies in even the most exposed sectors — consumer e-commerce, tech, and finance — have begun compliance efforts at all
• 30% estimate DPDP compliance costs could exceed 10% of annual turnover

The primary reason for this inertia? "No DPDP enforcement actions or fines have occurred through 2026, enabling a wait-and-see organizational mindset," the analysis noted. An unstaffed Board reinforces that mindset. It should not: obligations accrue from their commencement dates, not from the day the Board is seated.

Among the practical gaps companies face: legacy infrastructure typically lacks modular consent tracking; breach notification workflows need to be automated (the DPDP Act requires notifying both the Board and affected individuals of all breaches, with no GDPR-style risk threshold); and parental consent verification for users under 18 requires verifiable mechanisms that most Indian apps and platforms have not yet built.

---

#MeitY Is Also Considering Accelerating Deadlines for Big Platforms

Corporate India may not even have until May 2027. MeitY held stakeholder discussions on January 23, 2026, and put a significant proposal on the table: shortening the compliance deadline for Significant Data Fiduciaries (SDFs) from 18 months to 12 months — moving their hard deadline from May 13, 2027 to November 13, 2026.

If adopted, this would mean that large tech platforms, e-commerce companies, social media networks, and businesses processing data of more than 5 million residents (or with turnover above ₹250 crore) would need to be fully compliant at the same moment the Consent Manager Framework goes live.

MeitY also proposed:

• Immediate enforcement of cross-border data transfer restrictions, rather than the originally envisioned May 2026 start
• Accelerated notification of the SDF list and classification criteria
• 90-day data retention implementation deadlines for minimum retention requirements (1 year for standard entities, 3 years for e-commerce and social media platforms)

Industry body IAMAI pushed back in February 2026, publicly urging the government not to cut the compliance period. As of 1 November 2026, the compression remains a proposal; no final decision has been published.

SDFs face additional obligations that standard Data Fiduciaries do not: appointment of a Data Protection Officer and an independent Data Auditor, annual Data Protection Impact Assessments, periodic audits with findings reported to the DPBI, and cross-border data transfer restrictions. Non-compliance by SDFs can attract penalties up to ₹150 crore specifically for these additional obligations.

---

#The Supreme Court Is Watching Too

Alongside the regulatory developments, India's Supreme Court is hearing constitutional challenges to the DPDP Act itself. On February 16, 2026, Chief Justice Surya Kant and Justices Joymalya Bagchi and V.M. Pancholi issued notice on petitions challenging the Act's amendment of the Right to Information Act, referred them to a larger bench and declined a stay. On 27 October 2026 the Court issued notice on a broader writ by the Digital News Publishers Association, again refusing an ex parte stay (LiveLaw). Taken together, the petitions raise four core concerns:

1. Press freedom: The DPDP Act contains no journalistic purpose exemption — a significant departure from GDPR and most global data protection frameworks, which carve out space for journalism and public interest processing
2. RTI amendment: Section 44(3) of the Act amends Section 8(1)(j) of the Right to Information Act, and petitioners argue this effectively curtails citizens' ability to obtain information about public officials under the RTI framework
3. Government data access: Section 36 read with Rule 23 allows the Central Government to demand personal data from any Data Fiduciary on broad grounds including public order and national security — critics argue this lacks proportionality safeguards
4. Board independence: The DPBI's structural independence from government has been questioned, given that the Central Government appoints its leadership and the Board sits within the MeitY framework

The Supreme Court has not stayed the DPDP framework. For most businesses, the litigation does not change their compliance obligations — the Act and Rules remain in force. But it does signal that India's data protection framework may evolve further, and that civil society will continue to push for stronger individual rights protections.

---

#The DPDP Act vs. GDPR: Where India Is Stricter (and Where It Isn't)

Global companies operating in India frequently ask how the DPDP Act compares to Europe's GDPR. The short answer: narrower in scope, but stricter in certain specific areas.

Where DPDP is stricter than GDPR:

• All breaches must be notified, regardless of risk to the individual. GDPR only requires notification when breaches pose a high risk to natural persons.
• Consent is the primary legal basis. GDPR allows six bases; DPDP's "legitimate uses" are enumerated and narrow.
• Children's data threshold is 18 (vs. GDPR's 16), and behavioral tracking of children is flatly prohibited.

Where DPDP is less strict:

• Penalties are fixed per-violation amounts, not percentage of global turnover — meaning a startup faces the same ₹250 crore ceiling as Meta.
• Cross-border transfer rules are still being finalized. GDPR's adequacy and safeguard framework is operational; India's permitted jurisdiction list does not yet exist.
• No explicit data minimization or purpose limitation obligations as strong as GDPR's Article 5 principles.

For companies already GDPR-compliant, analysts estimate India-specific DPDP work runs 30–40% of what they spent on GDPR. For companies that are GDPR-naive, the full journey is longer — particularly around consent management infrastructure and verifiable consent records, where India's requirements are genuinely demanding.

---

#What Businesses Should Do Now

The Board's absence changes who will enforce the law and when, not what the law requires. The practical to-do list for Indian businesses:

Now:

• Complete a data mapping exercise — know what personal data you collect, where it lives, and how it flows to processors and third parties
• Audit existing privacy notices for DPDP compliance. Notices must be in plain language, specific about purpose, and available in a language chosen by the data principal
• Review contracts with data processors. Under the DPDP Act, data fiduciaries are responsible for processor compliance
• Identify whether you are likely to be designated a Significant Data Fiduciary — if so, plan for the possibility of a compressed timeline and start preparing DPO appointment, DPIAs, and audit frameworks

Before obligations commence:

• Have a functional consent management system operational, capable of interoperating with the Consent Manager framework once Consent Managers can be registered
• Implement automated breach detection and notification workflows, and keep a dated record of every intimation you would have made. Breach notification failures are a top-tier penalty category, and the Board will be able to examine them once it is seated
• Establish a grievance redressal mechanism. Data principals have rights under the DPDP Act — including the right to erasure, right to information about processing, and right to nominate another person to exercise their rights. You must be able to respond to these

If you are building consent infrastructure from scratch, explore our Consent Manager and review our DPDP compliance resources for implementation guides.

---

#The Bottom Line

India's Digital Personal Data Protection Act spent years in gestation and is now in force in stages — but the body meant to enforce it has yet to be staffed. MeitY called for applications in May and June 2026; nobody has been appointed; and a High Court has ordered the Board made functional by early December 2026. When it is seated, it will not start from a blank slate.

The companies that will struggle most are those still waiting for a Chairperson, final SDF designations, jurisdiction lists, and technical interoperability standards before they begin. Some of that will arrive. But the consent architecture, data mapping, and governance controls that form the spine of DPDP compliance do not require waiting. They require starting.

With 80% of companies behind on compliance, the first enforcement actions — when they come — will not lack for targets.

---

Sources: MeitY DPDP data protection framework · NASSCOM Community: MeitY invites applications for the Data Protection Board · LiveLaw: India's Data Protection Board — established in law, absent in fact · LiveLaw: Kerala High Court on the Data Protection Board (Digi Yatra PIL) · Bar & Bench: Kerala High Court seeks status of the Data Protection Board · indiadatalaw.org: Is the Board operational? · India Briefing: DPDP Compliance Timeline 2026-27 · S.S. Rana & Co: MeitY plans to cut DPDP compliance timeline · Mondaq: DPDP 2026 Reality Check · Mondaq: India's Data Protection Board – The Enforcer That Isn't There Yet · LiveLaw: Supreme Court refers DPDP/RTI challenge to larger bench · LiveLaw: DNPA challenge to the DPDP Act · Internet Freedom Foundation: Supreme Court DPDP Challenge · Storyboard18: Cabinet Secretary to head DPB search panel