Rule 19 - Procedure for meetings of Board and authentication of its orders, directions and instruments

Rule 19 establishes the procedural framework through which the Data Protection Board of India conducts its collective business, makes decisions, deals with conflicts of interest, responds to emergencies, authenticates its official acts and manages the time taken to complete inquiries. It must be read with the provisions of the Digital Personal Data Protection Act, 2023 concerning the Board’s composition, functioning, powers and inquiry process.

The Rule balances three institutional needs. First, the Board must function in an organised and formally accountable manner. Second, it must be capable of acting quickly where an urgent situation does not permit an ordinary meeting. Third, its proceedings must remain collective and procedurally credible, particularly where decisions may result in binding directions or substantial monetary penalties.

Rule 19 came into force on 13 November 2025, together with Rules 17 to 21 and the statutory provisions establishing the Board.

1.1 Governance of Board meetings

The Chairperson has primary responsibility for convening and organising meetings of the Board. This includes determining the date, time and place of the meeting, approving the agenda and ensuring that notice is issued.

This authority gives the Chairperson substantial administrative control over the orderly conduct of Board business. It enables the Chairperson to coordinate matters requiring collective consideration, arrange the sequence of business and ensure that Members know what will be discussed.

The power to approve the agenda should be understood as an institutional management function. It should not be used to prevent the Board from considering a matter that it is legally required to determine, to suppress a material issue raised by Members or to delay urgent statutory action without proper reason.

Meeting notices may be issued under the Chairperson’s signature or under the signature of another individual authorised by the Chairperson through a general or special written order. This permits administrative delegation without transferring the Chairperson’s underlying responsibility for deciding when the meeting will occur and what business will be placed before it.

A general order may authorise a designated officer to issue meeting notices as a routine administrative function. A special order may authorise a person to issue notice for a particular meeting or category of meeting. The requirement of written authority assists institutional accountability by ensuring that the power to issue formal meeting notices is traceable.

Although Rule 19 refers to the “place” of a meeting, this must be understood alongside Rule 20, under which the Board functions as a digital office. A meeting may therefore be organised through a physical, virtual or hybrid arrangement, provided the procedure preserves reliable participation, identity, confidentiality, voting and record keeping.

1.2 Presiding over meetings and continuity during the Chairperson’s absence

The Chairperson ordinarily presides over meetings. If the Chairperson is absent, the Members present choose one among themselves to chair the meeting.

This ensures that the Board does not become incapable of conducting business merely because the Chairperson cannot attend. The substitute presiding Member does not become the Chairperson for all statutory purposes. The Member performs the chairing function for that meeting and exercises the procedural powers attached to that role, including the casting vote where the votes are equally divided.

The selection should be recorded in the meeting record so that there is no uncertainty regarding who presided, managed the proceedings and authenticated any procedural decisions taken during the meeting.

The ability to choose a presiding Member supports continuity, but it does not eliminate the quorum requirement. A meeting cannot validly proceed merely because one Member is available and declares herself to be the presiding person. The minimum required participation must still exist.

1.3 Quorum and collective decision-making

One-third of the Board’s total membership constitutes the quorum. Quorum ensures that the Board does not take collective decisions through an unrepresentatively small number of Members.

The calculation should be based on the membership of the Board and applied in a practical manner where one-third does not produce a whole number. Since a fraction of a Member cannot be present, the required number must be treated in a way that ensures at least one-third participation. The Board should maintain a consistent recorded method for determining quorum.

Quorum should ordinarily exist throughout the transaction of substantive business. If Members leave during the meeting and participation falls below the required level, the Board should not continue deciding matters requiring a valid meeting merely because the quorum existed when the meeting began.

Questions arising at a meeting are decided by a majority of the Members present and voting. Abstentions do not ordinarily count as affirmative or negative votes, although an abstaining Member may still be present for quorum unless legally excluded because of a conflict of interest. The minutes should distinguish between absence, abstention and recusal because each has a different procedural significance.

If the votes are equally divided, the person chairing the meeting has a second or casting vote. This mechanism prevents deadlock. It does not give the Chairperson two votes in every matter. The Chairperson first votes as a Member and receives an additional casting vote only where the ordinary votes are equal.

The casting vote is legally significant because it may determine a contested matter, including a decision having regulatory or financial consequences. Its use should be clearly reflected in the record of proceedings. The reasons supporting the Board’s final decision must still be apparent from the order. A casting vote resolves the numerical tie, but it does not dispense with the need for a legally reasoned outcome.

1.4 Conflicts of interest

Rule 19 requires a Member having an interest in an item of business to refrain from participating in or voting on that item. The remaining Members decide the matter by majority of those present and voting.

This is an important safeguard of impartiality. The Board may decide matters affecting large companies, government bodies, technology providers, professional organisations and individuals with whom a Member may have had prior professional, financial or personal connections.

An interest may arise from circumstances such as:

• a financial connection with a party;

• current or recent employment;

• consultancy or advisory work;

• a material relationship with an interested organisation;

• direct involvement in the matter before appointment;

• or another circumstance creating a reasonable concern about impartiality.

Prior professional experience in a sector does not automatically disqualify a Member from every matter involving that sector. The concern is a sufficiently direct or material interest in the particular business before the Board.

The Rule requires non-participation, not merely abstention from the final vote. A conflicted Member should ordinarily not influence the discussion, receive unnecessary confidential material concerning the item or attempt to shape the decision outside the meeting.

The interest and recusal should be recorded. This protects both the integrity of the proceeding and the Member. It allows later verification that the matter was decided only by Members legally entitled to participate.

A practical difficulty may arise where recusals reduce participation below the ordinary quorum. Rule 19 states that the decision on the conflicted item is to be taken by a majority of the other Members present and voting, but it does not expressly create an alternative quorum for that situation. The Board should therefore apply a consistent procedure that preserves both the recusal obligation and the validity of collective action. Where recusals make a lawful decision impossible, the matter may need to be deferred or otherwise managed under the Act and applicable procedural rules rather than decided through conflicted participation.

1.5 Emergency action by the Chairperson

Rule 19 allows the Chairperson to take necessary action without calling a Board meeting where:

• an emergent situation requires immediate action; and

• calling a meeting is not feasible.

This is an exceptional power. It is not a general substitute for collective decision-making.

Both conditions must be present. A matter may be important without being urgent. A matter may be urgent while a virtual meeting remains feasible. In either case, the Chairperson should not bypass the Board merely for administrative convenience.

The emergency power may be relevant where delay would materially undermine the Board’s statutory functions, such as where an ongoing personal data breach requires immediate mitigation, evidence may be destroyed, unlawful access is continuing or urgent protective action is necessary.

The Chairperson must record reasons in writing. Those reasons should explain:

• the emergency;

• why immediate action was necessary;

• why a meeting could not feasibly be called;

• the action taken;

• and the relationship between that action and the Board’s statutory powers.

A bare statement that the matter was “urgent” would provide limited accountability. Written reasons are particularly important because the Chairperson is exercising a power that would ordinarily belong to the Board collectively.

The action must be communicated to all Members within seven days and placed before the Board for ratification at its next meeting. Ratification restores collective oversight. It gives the Board an opportunity to examine the action, approve it, seek further information or address its continuing effect.

The text does not expressly describe every consequence of refusal to ratify. That question may depend on the nature of the action, whether third-party rights have arisen, whether the measure was temporary and whether the Board has power to modify or withdraw it. The Chairperson should therefore use the emergency provision conservatively and, where possible, frame urgent action so that the Board can meaningfully review it.

1.6 Decision by circulation

Rule 19 also allows the Chairperson to refer an item to Members by circulation where the issue requires a Board decision. The matter is decided with the approval of a majority of the Members.

Circulation is different from emergency unilateral action. Under circulation, the Board still makes the decision collectively, but without convening a meeting. The Chairperson distributes the relevant material and Members communicate their approval or disagreement through the prescribed process.

This method is suitable where:

• the issue is sufficiently clear;

• Members have adequate written material;

• extensive oral deliberation is unnecessary;

• and the matter can be decided reliably through recorded communication.

The reference to a majority of the Members differs from a majority of Members present and voting at a meeting. On its ordinary wording, approval by circulation requires a majority of the Board’s membership, not merely a majority of the Members who choose to respond. Silence should not automatically be treated as approval.

The circulation record should show:

• the material supplied;

• the time allowed for consideration;

• the responses received;

• the votes or approvals;

• recusals;

• the final result;

• and the date of decision.

A circulation process should not be used where the matter requires substantial deliberation, examination of contested evidence or meaningful interaction among Members. In such situations, a meeting may provide the more appropriate forum.

1.7 Authentication of Board acts

An order, direction or instrument of the Board may be authenticated under the signature of:

• the Chairperson;

• any Member; or

• another individual authorised by the Board through a general or special written order.

Authentication is the formal act by which the decision or instrument is issued as an official act of the Board. It provides assurance that the document is genuine and has been issued under proper authority.

Authentication must be distinguished from decision-making. A person authorised to sign or authenticate an order does not thereby obtain power to decide the underlying matter. The Board may make the decision, after which an authorised individual formally authenticates the resulting document.

This distinction permits administrative efficiency. It would be unnecessarily burdensome if every procedural direction or instrument required the personal signature of the Chairperson. At the same time, the written authorisation should identify the category of documents or particular instrument that the person may authenticate.

Authentication should also conform to the Board’s digital-office model. Secure electronic signatures, controlled document-generation systems, audit trails and verifiable issuance records may be used in accordance with the applicable legal and technical framework.

A defect in authentication may differ from a defect in the decision itself. A properly made Board decision should be issued through the authorised process, but the legal consequence of a particular signature or authentication irregularity will depend on whether the defect is merely administrative or affects the document’s validity and reliability.

1.8 Completion of inquiries

Rule 19 requires the Board to complete an inquiry within six months from receipt of the relevant:

• intimation;

• complaint;

• reference; or

• direction under Section 27.

The period begins from receipt of the triggering matter, not from the date on which the Board chooses to commence substantive hearings. This prevents the inquiry clock from being postponed through internal administrative delay.

The six-month period promotes timely enforcement and procedural certainty. Delay can prejudice all participants. A Data Principal may remain without effective relief, while a Data Fiduciary may face prolonged regulatory uncertainty and continuing reputational or operational consequences.

The completion requirement should be understood as applying to the inquiry process contemplated by Section 27 and the related procedural framework. Completion ordinarily requires the Board to bring the inquiry to a reasoned outcome rather than merely finish collecting documents.

The Board may extend the six-month period, but each extension:

• must be supported by reasons recorded in writing; and

• cannot exceed three months at a time.

The Rule does not prescribe an express numerical limit on the number of extensions. It therefore permits successive extensions where genuinely necessary. However, this is not authority for indefinite renewal as a routine practice.

Each extension must be independently justified. Relevant reasons may include:

• involvement of several Data Fiduciaries or Processors;

• extensive technical evidence;

• cross-border evidence gathering;

• forensic examination;

• a large number of affected Data Principals;

• complex algorithmic systems;

• necessary expert analysis;

• procedural applications;

• or delay attributable to legally necessary cooperation with another authority.

Administrative workload alone should not automatically justify repeated extensions. The requirement to record reasons allows the extension to be assessed against fairness, necessity and the complexity of the case.

The Board should also distinguish delay attributable to a party from delay attributable to its own administration. Where a person fails to provide required information, the Board may use its statutory powers and procedural directions rather than allow the inquiry to remain open without active management.

1.9 Procedural fairness and efficiency

Rule 19 is chiefly concerned with internal Board procedure, but its operation can affect the rights of parties appearing before the Board.

Meeting procedure, emergency action, circulation and inquiry timelines must be applied consistently with:

• notice;

• opportunity to be heard;

• impartiality;

• reasoned decision-making;

• disclosure of relevant allegations;

• treatment of evidence;

• and the statutory inquiry process.

The Board’s ability to act efficiently does not remove procedural fairness. Conversely, procedural fairness does not require every administrative step to be taken at a physical meeting attended by the full Board.

The Rule provides several lawful decision-making routes:

• decision at a quorate meeting;

• decision by circulation;

• emergency action by the Chairperson followed by ratification;

• and formal authentication of the resulting act.

The appropriate route depends on the nature and urgency of the matter.

An inquiry resulting in a significant monetary penalty will ordinarily require careful adherence to the statutory inquiry and hearing safeguards. Emergency powers may support temporary protective measures, but they should not become a substitute for the full process required before a final adverse determination.

1.10 Records and institutional accountability

Although Rule 19 does not reproduce a detailed record-management code, its operation necessarily requires reliable records of:

• meeting notices;

• agendas;

• attendance;

• quorum;

• declared interests;

• recusals;

• votes;

• casting votes;

• circulation decisions;

• emergency reasons;

• communications to Members;

• ratification;

• authentication authority;

• inquiry commencement;

• extensions;

• and final orders.

These records are essential to demonstrate that a decision was made by the correct persons, through the correct procedure and within the applicable period.

Because the Board functions as a digital office, these records should be maintained with appropriate security, integrity and auditability. An official record should reveal not only the final result but also the authority under which the act was taken.

1.11 Overall interpretation

Rule 19 establishes a flexible but accountable governance framework for the Data Protection Board.

Ordinary business is conducted through meetings convened and organised by the Chairperson, subject to quorum and majority voting. The Board can continue functioning in the Chairperson’s absence by choosing another Member to preside. Interests must be disclosed through non-participation and non-voting. Deadlocks are resolved through a casting vote.

Where a meeting cannot feasibly be called in an emergency, the Chairperson may act for recorded reasons, but the action remains subject to communication and later ratification. Where a matter does not require a meeting, it may be decided by circulation with approval of a majority of the Board’s Members. Official orders and directions may be authenticated by the Chairperson, a Member or a duly authorised individual.

The six-month inquiry period, coupled with reasoned extensions of no more than three months at a time, is intended to prevent regulatory proceedings from remaining unresolved without justification. The extension mechanism recognises that technically difficult or large-scale matters may require more time, but it requires the Board to account for that delay in writing.

Rule 19 consequently combines collective decision-making, administrative flexibility, impartiality, urgency and timeliness. Its proper use is central to the credibility of the Board because the legitimacy of enforcement depends not only on the substantive correctness of a decision but also on whether the decision was made by an authorised, quorate and impartial body through a fair and traceable procedure.