Central Government yet to Notify Selection Panels for Data Protection Board

Why It Matters

Without a staffed DPBI, India’s new data‑privacy regime lacks an enforcement engine, potentially weakening compliance incentives for tech firms and data fiduciaries.

Key Takeaways

• DPBI still lacks appointed chairperson and members after five months
• Selection committees for DPBI appointments have not been notified yet
• Board can levy fines up to Rs 250 crore (~$30 M) on violators
• Court ordered Instagram case to be referred to DPBI for resolution
• Delayed appointments risk slowing enforcement of India’s data‑privacy rules

Pulse Analysis

India’s Digital Personal Data Protection (DPDP) rules, rolled out in November 2025, introduced a comprehensive framework for personal data governance. Central to the regime is the Data Protection Board of India (DPBI), a quasi‑judicial body tasked with investigating breaches, adjudicating complaints, and imposing penalties. By granting the board authority to fine violators up to Rs 250 crore (about $30 million), the legislation signals a strong regulatory intent to protect user data and hold large data fiduciaries accountable.

Despite the board’s legal mandate, the government has yet to convene the selection committees that will appoint its chairperson and four full‑time members. Officials cite ongoing software development and procedural finalisation, but the delay means the DPBI cannot yet exercise its enforcement powers. This gap is already evident as courts are directing cases—such as the recent Instagram encryption dispute—to a board that lacks members, creating uncertainty for litigants and data controllers alike. The inability to issue "reasoned and speaking orders" could stall timely redress and undermine the credibility of the DPDP framework.

The broader impact on India’s tech ecosystem could be significant. Companies operating in the country, from global platforms to domestic startups, are preparing for compliance costs and governance upgrades. A functional DPBI would provide clear guidance and a predictable enforcement pathway, encouraging investment in security measures. Continued appointment delays risk a regulatory vacuum, potentially prompting firms to adopt a wait‑and‑see approach rather than proactively strengthening data safeguards. Stakeholders are watching closely for the government’s next move, as a fully staffed board will be pivotal in shaping India’s data‑privacy landscape over the coming years.