Cabinet Secretary to head Search panel for India’s new data protection board chairperson

Central Government has notified the Digital Personal Data Protection (DPDP) Rules, 2025, and placed the selection of India’s first Data Protection Board (DPB) Chairperson under a high-powered committee chaired by the Cabinet Secretary.

According to Rule 17 of the newly published framework, the government will constitute a Search-cum-Selection Committee with the Cabinet Secretary at the helm, joined by the Secretaries of the Department of Legal Affairs and the Ministry of Electronics and Information Technology (MeitY), along with two experts of repute possessing practical or specialised knowledge relevant to the Board’s mandate.

This committee will recommend individuals for appointment as the Chairperson of the DPB, marking one of the most senior-level selection processes in India’s digital governance architecture.

Separate Committee for Appointing Members

For appointing other Members of the Board, the DPDP Rules create a second committee — chaired by the MeitY Secretary, with the Secretary of Legal Affairs and two domain experts.

Both committees have been given procedural immunity: their decisions cannot be challenged merely due to vacancies or defects in composition, enabling the government to fast-track appointments without procedural delays.

A Lean but Senior-Led Regulator

While the appointment process is headed by India’s top bureaucratic leadership, the DPB itself is designed to be lean. As per the Fifth Schedule:

The Chairperson will receive ₹4.5 lakh per month,

Members will receive ₹4 lakh per month,

No housing, car, pension, gratuity, sitting fees or sumptuary allowances apply.

Digital-First Operations and Strict Timelines

Rule 20 states that the Board will function as a digital office, conducting proceedings without requiring physical presence. All orders and instruments may be authenticated digitally.

Under Rule 19, the Board must complete inquiries within six months, extendable in blocks of three months with written reasons.

Phased Implementation of DPDP Rules

The notification formally kicks off the timeline for implementation:

Rules 1, 2 and 17–21 take effect immediately.

Rule 4 (Consent Manager registration) becomes operational in one year.

Rules 3, 5–16, 22 and 23 come into force 18 months post-publication.

By placing the Cabinet Secretary at the centre of the selection process, the government has signalled the strategic importance of the Data Protection Board — even as it builds a regulator intentionally structured to be lightweight, digital, and fast-moving under the DPDP Act.