LokVox
ENहिंदी
Subscribe
Friday, 16 October
Sensex74,729.27+0.56%
Nifty 5023,146.15+0.65%
₹ / $94.89−0.10
Repo rate5.50%+0.25 on 7 Oct
Markets: 16 Oct close
The people’s newsroom

PolicyData protection

Consent managers arrive on 13 November, but the Data Protection Board has no members

The second phase of India's data protection rules begins next month. The regulator meant to oversee it still has no chairperson or members, five months after the government invited applications.

From the editorial desk · New DelhiPublished
A man looking at his smartphone
A man looking at his smartphoneBhullargraphic / Wikimedia

Key points

  1. The consent manager framework under the Digital Personal Data Protection Rules, 2025 begins on 13 November 2026, one year after the rules were notified.
  2. The Data Protection Board of India was legally established in November 2025 but has no chairperson or members, according to LiveLaw and the India Data Law tracker.
  3. MeitY invited applications for a chairperson and four members on 6 May 2026; no appointment has been announced.
  4. Most obligations on companies, and the Board's power to impose penalties of up to ₹250 crore, take effect on 13 May 2027.

The framework for consent managers under India’s data protection law begins on 13 November 2026. The Data Protection Board, which is meant to oversee them, still has no chairperson or members, according to LiveLaw and the India Data Law tracker.

The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and come into force in phases over 18 months. The provisions setting up the Board took effect on notification. The consent manager framework starts a year later, and most obligations on companies apply from 13 May 2027.

Consent managers are companies that give people one platform to give, manage, review and withdraw consent for the use of their personal data. Under the rules they must be companies based in India, and they work under the Board’s oversight, according to the government’s backgrounder on the rules.

A board in law only

The Board was established in law when the rules were notified. The Ministry of Electronics and Information Technology (MeitY) invited applications for a chairperson and four members in a circular dated 6 May 2026, and a recruitment advertisement followed on 6 June, according to India Data Law.

Two search-cum-selection committees are handling the appointments, one chaired by the Cabinet Secretary for the chairperson and one chaired by the MeitY Secretary for the members, LiveLaw reported. A Lok Sabha written answer on 12 August confirmed the advertisement, according to India Data Law.

A Board with no Members cannot convene a bench, cannot hear a party, and cannot sign an order, reasoned or otherwise.

Raghvendra Kumar Chaudhary, assistant professor of law, CHRIST (Deemed to be University), writing in LiveLaw, 1 August 2026

India Data Law, which checks the Board’s status monthly, says it “cannot receive a complaint and it cannot pass an order.” LokVox found no report of an appointment up to 11 October 2026.

DPDP Rules: the phased timeline

  1. Nov 2025Rules notified; provisions establishing the Data Protection Board take effect
  2. 6 May 2026MeitY invites applications for a chairperson and four members
  3. 6 Jun 2026Recruitment advertisement published
  4. 13 Nov 2026Consent manager framework begins
  5. 13 May 2027Most obligations on companies take effect, along with the Board's powers to inquire and penalise

Why it matters before May 2027

From 13 May 2027, the Board’s powers to inquire into breaches and impose penalties take effect, India Data Law says. Under the Act, failure to keep reasonable security safeguards can draw a penalty of up to ₹250 crore, and failure to report a breach or meet obligations on children’s data up to ₹200 crore, according to the PIB backgrounder.

Companies must also report personal data breaches to the Board. Appeals against the Board’s decisions go to the Telecom Disputes Settlement and Appellate Tribunal.

The Data Protection Board

  • 1 + 4chairperson and members sought by MeitY in May 2026
  • 0appointments announced as of 11 Oct 2026
  • ₹250 croremaximum penalty, for failing to keep reasonable security safeguards

What is still unknown

LokVox found no public statement from MeitY on when the appointments will be made. The government has said the Board will work as a digital office, with complaints filed and tracked online through a portal and app; that system cannot hear cases until members are in place.

The documents