Appoint the Data Protection Board before the rules bite

The Digital Personal Data Protection Rules were notified in November 2025, and the provisions setting up the Data Protection Board took effect the same day. Nearly 11 months later the Board has no chairperson and no members. The Ministry of Electronics and Information Technology invited applications on 6 May 2026. Five months on, no one has been named.

The government should make these appointments before the year ends.

A regulator on paper

A board with no members cannot hear a complaint or pass an order. That has not mattered much so far, because the rules come into force in phases. It will start to matter on 13 November, when the consent manager framework begins. Consent managers are companies that will hold and manage people’s consent across many services, and they work under the Board’s oversight.

It will matter far more on 13 May 2027. From then, most duties on companies apply, and the Board gets its powers to inquire into breaches and impose penalties of up to ₹250 crore. Companies will also have to report data breaches to it.

A regulator needs time before it can use those powers well. It needs staff, a registry, procedures for hearings, and the digital complaints system the government has promised. People cannot be expected to trust a body that opens its doors on the day the penalties begin.

The government’s best argument

There is a fair case for the pace so far. The phased design gives companies 18 months to prepare, and a Board with little to enforce in its first year would have had little to do. Choosing a chairperson and members for a new regulator through two search-cum-selection committees, one chaired by the Cabinet Secretary, takes care. A hurried appointment of the wrong people would do lasting harm.

That argument holds for a few months. It weakens with each one that passes. The selection process began in May, and the posts were advertised in June. The Board also needs members before consent managers start up, since they come under its oversight. And the law requires at least one member with legal expertise, alongside domain knowledge in data governance, dispute resolution, technology or the digital economy, according to LiveLaw. That is a pool that can be searched in months.

Independence starts with appointment

How the Board is filled matters as much as when. The Board will rule on complaints against the organisations that collect and process people’s personal data, some of them very large. Its credibility depends on people believing it will act without fear.

The government can help by being open about the process: how many applications it received, who sits on the two selection committees, and when it expects to finish. None of that would compromise the choice of individuals.

The reporting behind this view

• Nov 2025Board established in law when the DPDP Rules were notified
• 0 of 5chairperson and member posts filled as of Aug 2026; no appointment reported since
• ₹250 croremaximum penalty the Board can impose from 13 May 2027

What the government should do

MeitY should announce the chairperson and four members by 31 December 2026. That leaves about four and a half months for the Board to hire staff, publish its procedures and test its complaints portal before 13 May 2027.

Until then, MeitY should publish a short monthly status note on the selection process. People who will soon be asked to trust this regulator with their complaints should at least be able to see it being built.