The Data Protection Board isn't operational yet — use the runway
The Data Protection Board of India exists in law but isn't functioning yet — no chairperson or members are in office. MeitY only invited applications in May 2026. This is a window to prepare, not an excuse to delay.
Where things stand
The Data Protection Board of India is the body that will adjudicate complaints and impose penalties under the DPDP Act (established by section 18). As of mid-2026 it is not yet operational — there is no sitting chairperson or members.
MeitY invited applications for the chairperson and four members in May 2026, so the appointments process has begun but isn't complete.
Why it matters
Right now there's no active regulator handing out DPDP penalties. It's tempting to read that as "nothing to do." That's the wrong takeaway: the obligations are still scheduled, and the Board can begin enforcing once constituted.
What this means for you
Treat this as breathing room to get compliant ahead of enforcement — not as a reason to wait. The businesses that prepare during this gap will be ready when the Board starts work.
Ignore any "named chairperson" you might see in unofficial sources (including a vandalised Wikipedia infobox) — no chairperson or members are appointed yet.
What to do now
Quick winUse this enforcement gap to get compliant now — map data, fix consent and shore up security — so you're ready when the Board is constituted.
- you're wondering whether anyone is enforcing DPDP yet
- you want to prepare ahead of active enforcement
DPDP Act, 2023 (India Code) · DPDP Act 2023, s.18 (Board); MeitY recruitment notice, May 2026
Don't just read it — find out where you stand.
A free scan shows what your live site is exposing today. When you're ready to be audit-ready, our Compliance Sprint gets you DPDPA-ready in 30 days.
General information, not legal advice. Verify against the cited primary source and confirm specifics with a qualified advisor before acting.