Rule 17 - Appointment of Chairperson and other Members of Board

Rule 17 prescribes the institutional process for selecting and appointing the Chairperson and other Members of the Data Protection Board of India. It gives effect to Section 19(2) of the Digital Personal Data Protection Act, 2023, which leaves the manner of appointment to the Rules.

Unlike the substantive obligations governing Data Fiduciaries, Rule 17 came into force on 13 November 2025, the date on which the final Rules were published. The provisions of the Act concerning establishment, composition and administration of the Board were also brought into force during this initial institutional phase.

The Rule creates a two-stage appointment process. A Search-cum-Selection Committee first identifies and recommends suitable individuals. The Central Government then considers those recommendations and makes the appointment. Separate committees are prescribed for the Chairperson and for the other Members, with the committee recommending the Chairperson being chaired at the higher level of the Cabinet Secretary.

1.1 Relationship with the DPDPA

Section 18 establishes the Data Protection Board of India as a body corporate with perpetual succession and the capacity to hold property, contract, sue and be sued. Section 19 provides that the Board will consist of a Chairperson and such number of other Members as the Central Government may notify. It also prescribes the broad qualifications that the Chairperson and Members must possess.

Under Section 19, the Chairperson and Members must be persons of ability, integrity and standing with special knowledge or practical experience in one or more fields relevant to the Board’s work. These fields include data governance, administration or implementation of social or consumer-protection laws, dispute resolution, information and communication technology, digital economy, law, regulation and techno-regulation. At least one person among the Chairperson and Members must be an expert in law.

Rule 17 does not replace these statutory qualifications. The Search-cum-Selection Committees must recommend individuals who satisfy them. The Rule determines how candidates are identified and recommended, while Section 19 determines the broad standard of suitability that appointees must meet.

The framework therefore involves three institutional decisions:

1. the Central Government determines the number of Members through notification;

2. the relevant Search-cum-Selection Committee recommends suitable individuals; and

3. the Central Government appoints the Chairperson or Member after considering those recommendations.

1.2 Separate processes for the Chairperson and other Members

The Rule deliberately establishes different Search-cum-Selection Committees for the Chairperson and the other Members.

The committee for the Chairperson is chaired by the Cabinet Secretary. It also includes:

• the Secretary in charge of the Department of Legal Affairs;

• the Secretary in the Ministry of Electronics and Information Technology; and

• two experts of repute with special knowledge or practical experience in a field considered useful to the Board.

The committee for Members other than the Chairperson is chaired by the Secretary of the Ministry of Electronics and Information Technology. It also includes:

• the Secretary in charge of the Department of Legal Affairs; and

• two experts of repute with relevant special knowledge or practical experience.

The distinction reflects the Chairperson’s institutional position. The Chairperson leads the Board and plays a central role in its functioning, administration and allocation of Board business. The higher-level committee chaired by the Cabinet Secretary therefore provides a more senior interdepartmental mechanism for selecting the person who will head the institution.

The selection of other Members remains under a committee chaired by the MeitY Secretary, which reflects the Ministry’s administrative responsibility for the DPDPA framework. The participation of the Department of Legal Affairs is important because the Board exercises adjudicatory, remedial and penalty-related functions. The expert members are intended to add specialist knowledge beyond ordinary governmental administration.

1.3 The significance of multidisciplinary selection

The Data Protection Board will not deal only with abstract questions of privacy law. Its work may require understanding of:

• security safeguards and personal data breaches;

• information systems and cloud infrastructure;

• consent platforms;

• algorithmic systems;

• children’s data;

• identity verification;

• data retention and erasure;

• Processor relationships;

• cross-border data flows;

• consumer-facing digital services;

• corporate governance;

• and the practical consequences of regulatory directions.

For this reason, the Act permits appointments from a broad range of relevant fields rather than restricting membership to judges or lawyers. The expert members of the Search-cum-Selection Committees can assist in evaluating whether a candidate possesses the practical and technical competence necessary for the Board’s responsibilities.

A technically sophisticated Board nevertheless requires legal competence because its functions include interpreting statutory obligations, conducting inquiries, issuing binding directions and imposing monetary penalties. This explains the statutory requirement that at least one person among the Chairperson and Members be a legal expert.

Illustration

Suppose candidates for appointment include:

• a former regulator experienced in consumer protection;

• a cybersecurity professional with extensive breach-response experience;

• a technology-policy expert;

• a lawyer specialising in digital regulation; and

• an administrator experienced in public-sector digital systems.

The statutory framework permits a multidisciplinary Board drawn from these backgrounds. It does not require every Member to possess identical expertise. What matters is that each appointee satisfies the standard of ability, integrity and standing, possesses useful special knowledge or experience, and that the Board collectively includes the required legal expertise.

1.4 Recommendation and final appointment

The Search-cum-Selection Committee recommends individuals. The Central Government makes the appointment after considering their suitability.

The recommendation stage is therefore not itself the final appointment. Nor does the text state that the Central Government must appoint the first-ranked person automatically. The Government retains the appointment function and must consider the suitability of the recommended individuals.

At the same time, the structure does not appear to permit appointment through a completely unrelated process that disregards the Committee. The purpose of constituting the Committee is to identify and recommend candidates within the prescribed institutional framework. The Central Government’s choice is made after considering those recommendations.

Suitability should be understood in light of the statutory criteria, including:

• professional ability;

• integrity;

• public standing;

• relevant knowledge or practical experience;

• absence of statutory disqualification;

• and the collective expertise required for the Board to discharge its functions.

The appointment process should also be read with the provisions governing tenure, service conditions, disqualification, resignation, removal, filling of vacancies and restrictions following cessation of office. Rule 17 governs entry into office, but the suitability and independence of the appointee are supported by the wider institutional framework in the Act and Rules.

1.5 Role of the expert members

The Central Government selects two experts of repute for each Search-cum-Selection Committee. Their expertise must be in a field that, in the Government’s opinion, may be useful to the Board.

This formulation provides flexibility because the Board’s regulatory environment will evolve. Expertise useful at one stage may differ from expertise required later. Depending on the Board’s institutional needs, relevant experience could arise from:

• privacy and data governance;

• information security;

• digital platforms;

• regulatory enforcement;

• adjudication;

• artificial intelligence;

• consumer protection;

• administrative law;

• public policy;

• digital identity;

• or large-scale technology implementation.

The expert members do not themselves appoint the Chairperson or Members. They participate in the Committee’s assessment and recommendation process.

Their contribution should improve the Committee’s ability to assess substantive competence rather than merely formal credentials. For example, a candidate’s seniority in an organisation does not necessarily establish expertise in data governance, while a person with extensive practical experience in incident response, regulatory decision-making or digital systems may have highly relevant competence even without having held a conventional privacy title.

1.6 Vacancies, absence and defects in the Committee

Rule 17 protects the validity of the Committee’s acts and proceedings against challenge merely because:

• a position on the Committee is vacant;

• a member was absent; or

• there was a defect in the Committee’s constitution.

The objective is institutional continuity. Appointment proceedings should not automatically collapse because one member could not attend, an expert position temporarily became vacant or a technical irregularity existed in constitution of the Committee.

This protection is important because otherwise an appointment process could be delayed substantially through objections that do not affect the fairness or substance of the recommendation.

However, this clause should not be understood as validating every possible illegality.

The Rule uses the expression “merely”. Its effect is to prevent invalidation solely on account of a vacancy, absence or constitutive defect. It does not necessarily protect proceedings involving:

• bad faith;

• deliberate exclusion of required participation;

• consideration of legally ineligible candidates;

• material conflict of interest;

• fabrication of records;

• disregard of mandatory statutory qualifications;

• or a process having no meaningful resemblance to the Committee required by the Rule.

1.7 Illustration: Temporary absence

One expert member is unable to attend a meeting because of illness. The other members consider the candidates and make recommendations.

The proceeding cannot be challenged merely because that expert member was absent.

1.8 Illustration: Material illegality

A person who does not satisfy the statutory qualification requirements is appointed through a process that deliberately ignores Section 19. An objection to that appointment would not merely concern a vacancy or absence in the Committee. It would concern compliance with the parent Act itself.

The clause therefore supports continuity without converting procedural protection into immunity from substantive illegality.

1.9 Institutional independence and the appointment structure

The appointment mechanism is executive-led. The Central Government:

• constitutes both Search-cum-Selection Committees;

• selects the expert members;

• determines the fields considered useful to the Board;

• considers the recommended candidates;

• and makes the final appointments.

This structure should be stated accurately. Rule 17 does not establish appointment by Parliament, the judiciary or an independent constitutional body.

At the same time, the Rule introduces elements intended to support structured selection:

• recommendations are made through a formally constituted committee;

• legal and technology-administration expertise are represented;

• external experts participate;

• candidates must satisfy statutory qualifications;

• and the Chairperson’s selection is led by the Cabinet Secretary rather than by only one departmental authority.

Institutional independence cannot be assessed solely from the appointment rule. It also depends on:

• tenure;

• eligibility for reappointment;

• grounds and process for removal;

• service conditions;

• reporting structure;

• control over proceedings;

• administrative resources;

• conflict-of-interest safeguards;

• and the practical ability to decide cases impartially.

Rule 17 addresses only the selection and appointment stage. It should not be treated either as conclusive proof of complete independence or as conclusive proof of absence of independence.

1.10 Conflicts of interest and integrity

The Rule does not prescribe a detailed conflict-of-interest procedure for the Search-cum-Selection Committees. Nevertheless, the statutory requirement that appointees be persons of integrity and standing, together with the nature of the Board’s duties, makes conflicts materially relevant.

A candidate may have prior connections with:

• a regulated digital platform;

• a large Data Fiduciary;

• a technology vendor;

• a privacy advocacy organisation;

• government administration;

• litigation involving the DPDPA;

• or a consulting organisation advising regulated entities.

Prior professional experience does not automatically make a candidate unsuitable. Indeed, practical experience may be one reason for considering the person. The relevant questions concern whether:

• the interest is current or continuing;

• it could affect impartiality;

• it has been disclosed;

• it can be managed through recusal or other safeguards;

• or it creates a conflict incompatible with appointment.

The same principle should apply to Committee members evaluating candidates. A member having a material personal or professional connection with a candidate should not participate without appropriate consideration of the conflict.

1.11 Transparency and reasoned institutional design

Rule 17 does not expressly prescribe:

• a public advertisement for candidates;

• publication of a shortlist;

• public interviews;

• disclosure of the Committee’s deliberations;

• or publication of comparative reasons for selection.

Those measures should therefore not be presented as express statutory obligations under Rule 17.

Nevertheless, the legitimacy of the Board will depend partly on confidence that appointees possess the qualifications required by Section 19. Publication of appointment notifications and relevant professional information can help demonstrate that the institutional requirements have been satisfied, subject to the applicable legal framework.

The balancing question is how to maintain an effective and candid selection process while providing adequate public assurance concerning the competence and suitability of the appointees.

1.12 Relationship with the Board’s enforcement functions

The significance of Rule 17 becomes clearer when read with the Board’s powers.

The Board may receive breach intimations, direct urgent mitigation, inquire into personal data breaches and other failures, issue binding directions and impose monetary penalties where the statutory conditions are met. It also deals with complaints from Data Principals, references from governments and specified matters involving Consent Managers and intermediaries.

The Chairperson and Members may therefore consider disputes involving:

• major technology platforms;

• banks and insurers;

• employers;

• healthcare institutions;

• government authorities;

• Significant Data Fiduciaries;

• Consent Managers;

• and smaller Data Fiduciaries.

Their decisions may affect both individual rights and large-scale digital operations. The selection process must consequently identify persons capable of understanding law, evidence, technology, administrative fairness and the practical consequences of regulatory orders.

Illustration

A proceeding concerns whether a large cloud-based platform maintained reasonable security safeguards before a breach affecting millions of Data Principals.

The Board may need to understand:

• authentication and access management;

• encryption and key control;

• logging;

• Processor contracts;

• incident timing;

• forensic evidence;

• breach notification;

• and the statutory standard of reasonableness.

A multidisciplinary Board is better placed to examine such a dispute than one whose members possess expertise in only a single field.

1.13 Status of appointment proceedings

Rule 17’s vacancy-protection clause applies to the acts and proceedings of the Search-cum-Selection Committee, not generally to every act of the Data Protection Board.

Vacancies or absences affecting the Board’s own proceedings are governed by the Act and the separate Rules concerning Board meetings, quorum, decision-making and authentication of orders.

This distinction matters because the Search-cum-Selection Committee is a temporary recommending mechanism, while the Board is the continuing statutory institution exercising regulatory and adjudicatory functions.

The validity of a recommendation and the validity of a later Board order must therefore be assessed under their respective provisions.

1.14 Overall interpretation

Rule 17 establishes a structured executive appointment process for the leadership and membership of the Data Protection Board of India.

Its principal features are:

• separate Search-cum-Selection Committees for the Chairperson and other Members;

• higher-level chairing of the Committee selecting the Chairperson;

• participation of the Department of Legal Affairs and MeitY;

• inclusion of two outside experts of repute;

• recommendation of suitable candidates rather than direct appointment by the Committee;

• final appointment by the Central Government after consideration of suitability; and

• protection of Committee proceedings against invalidation merely because of vacancy, absence or a defect in constitution.

The Rule should be applied together with Section 19’s requirements of ability, integrity, standing, relevant expertise and minimum legal representation. The Committee cannot recommend suitability in the abstract. Suitability must relate to the Board’s actual functions and the statutory qualifications.

The vacancy-protection provision ensures continuity but does not displace substantive legality. The Central Government retains significant control over the process, while the committee structure introduces legal, administrative, technological and expert participation.

Key point

Rule 17 is the institutional gateway to the Data Protection Board. Its purpose is not merely to fill offices, but to create a structured process for identifying persons capable of interpreting the DPDPA, understanding complex digital processing and exercising substantial regulatory powers fairly. The effectiveness and credibility of the Board will therefore depend not only on formal compliance with the appointment procedure, but on whether the process produces a genuinely multidisciplinary body composed of persons meeting the statutory standards of ability, integrity, standing and relevant expertise.