BREAKING: Data Protection Board to have a chairperson and four members, headquarters set in Delhi

The Ministry of Electronics and Information Technology (MeitY) has officially notified the Digital Personal Data Protection (DPDP) Rules, 2025, laying out the operational framework for India’s data protection regime under the DPDP Act, 2023. The notification follows public consultation on the draft rules issued in January this year, with objections and suggestions now incorporated by the government.

BREAKING: Govt notifies final DPDP Rules; sets staggered rollout with key obligations for Data Fiduciaries

As per the rules, the structure of the Data Protection Board (DPB), which will function with a chairperson and a four-member composition and be headquartered in New Delhi.

BREAKING: DPDP final rules out: Consent managers face tight eligibility; e-commerce & social platforms get 3-year data limit

The board, established under the Digital Personal Data Protection Act (DPDPA) 2023, will act as the adjudicatory body for data breaches, user complaints, and non-compliance cases involving companies and intermediaries. The four members will include a chairperson and three full-time members with expertise in law, technology, cybersecurity, and governance.

Once operational, the DPB will be responsible for issuing penalties, directing remedial actions, and ensuring that data fiduciaries follow the obligations laid out in the Act.