DPDP Rules status: compliance window active. Read the update

Skip to content
Data Privacy · Enforcement status

Is the Data Protection Board of India operational yet?

Can the Board hear your complaint yet? Here is what we can confirm from primary sources.

Educational only · not legal adviceLast updated: 6 October 2026Written and edited by Sandesh Kokate

Short answer

The Board is established in law (DPDP Act s.18; G.S.R. 843(E)). As notified, it has a Chairperson and four Members, to be appointed through a Search-cum-Selection Committee (Government reply, Lok Sabha Unstarred Question 3960, 12 August 2026). The posts were advertised in Employment News on 6 June 2026. The reply does not report any appointment. We have found no appointment order since. Last checked 6 October 2026.

The detail

"Constituted" and "operational" are different things. Sections 18–26 of the DPDP Act create the Data Protection Board and set its composition. These sections commenced on 13 November 2025 alongside the DPDP Rules 2025. That gave the Board a legal existence. It also gave the government the machinery to appoint a Chairperson and Members.

Official text — Lok Sabha Unstarred Question 3960, answered 12 August 2026 (Phase 1)
As notified, the Board is composed of Chairperson and four Members, who are to be appointed through a Search-cum-Selection Committee. The advertisement for recruitment to the posts of Chairperson and Members was published in the Employment News on 6 June 2026.

The reply says nothing about Consent Manager registrations, breach reports or complaint numbers, so we give no numbers.

The complaint route is also not live. Under the Act, a Data Principal must first go to the Data Fiduciary's own grievance-redressal process. Only then can she approach the Board. That second step has nowhere to go yet. The Board's power to inquire into complaints (Section 27) starts on 13 May 2027 (G.S.R. 843(E)(c)).

The duties a complaint would be about include notice, consent, security, breach reporting, and rights. None of these are enforceable until 13 May 2027. That is also when section 33 and the Schedule of penalties take effect.

Where the Board sits in the timeline

13 Nov 2025Board provisions in force

Sections 2 and 18–26 started, with Sections 35, 38–43, 44(1) and 44(3) (G.S.R. 843(E)(a)). Rules 1, 2 and 17–21 started too (Rule 1(2)). The Board exists in law. We have not confirmed any member appointments.

13 Nov 2026Consent Manager registration opens

Section 6(9), section 27(1)(d) and Rule 4 commence, giving the Board its first live registration function.

13 May 2027Core obligations and penalties enforceable

Notice, consent, security, breach reporting, retention, children's data, Significant Data Fiduciary duties, rights, cross-border transfers and section 33 penalties all take effect — the point from which the Board can adjudicate and fine.

What this means for you

Founders

No regulator is knocking today, but your own grievance-redressal process must exist and work by 13 May 2027 — it is the first step every complaint runs through.

Freelancers

Clients asking you to prove "Board compliance" are asking for something that does not exist yet; build to the Act's duties instead.

Creators

If a platform mishandles your data now, the DPDP complaint route is not available — existing IT Act and consumer channels are what you have.

Status

In ForceSections 18–26 in force since 13 November 2025. See the status line above. Penalties enforceable from 13 May 2027.

Read next

The Data Protection Board

How the Board is built, what it can do, and how complaints will reach it.

Is the DPDP Act in force yet?

In force vs enforceable, and the three commencement phases.

Data-breach response

The clocks that start when a breach happens, and who you must tell.

Primary sources

Source
MeitY — DPDP Act (Gazette PDF)

Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (Act 22 of 2023) — sections 18–26 establish the Board.

Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).

Source
MeitY — Appointment to the post of Chairperson and Other Members, DPBI (6 May 2026)

Board appointment process — nominations invited from Ministries, Departments and States, 6 May 2026.

Notified — checked 2026-10-06. Opened the MeitY notice F. No. 2(1)/2026-Pers.I dated 6 May 2026.

Source
MeitY — DPDP Rules, 2025 (Gazette PDF)

G.S.R. 846(E), 13 November 2025 (Gazette publication ID CG-DL-E-14112025-267650, published 14 November 2025) — sets the phased commencement dates; Rule 4 (Consent Manager registration, the Board's first live function) commences 13 November 2026.

Notified — checked 2026-10-06. Opened the DPDP Rules, 2025 (Gazette PDF).

Companion notifications issued the same day (13 November 2025)

  • G.S.R. 843(E), 13 November 2025 — Phased commencement of the DPDP Act's sections.
  • G.S.R. 844(E), 13 November 2025 — Board-related notification. Cited by number only; not opened.
  • G.S.R. 845(E), 13 November 2025 — Board-related notification. Cited by number only; not opened.

Cited by number and date only. We do not link them, and we do not rely on 844(E) or 845(E) for the Board's make-up. For that we cite the Lok Sabha reply of 12 August 2026.

Citation

Kokate, S. (2026). Is the Data Protection Board of India operational yet? India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/is-the-data-protection-board-operational. Educational content, not legal advice.

← Back to Data Privacy hubThe Data Protection Board →

The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.