Rule 21 provides the staffing framework for the Data Protection Board of India. It authorises the Board to appoint the officers and employees necessary for discharging its statutory functions, but makes that appointment power subject to the prior approval of the Central Government. The terms and conditions governing those personnel are prescribed in the Sixth Schedule.
Rule 21 came into force on 13 November 2025, together with the provisions establishing the Board and regulating its initial institutional functioning.
The Rule must be understood in the context of the Board’s role under the DPDPA. The Chairperson and Members constitute the decision-making body, but the Board cannot carry out its regulatory and adjudicatory functions through Members alone. It requires an administrative and professional establishment capable of receiving breach intimations and complaints, scrutinising filings, managing digital proceedings, handling technical evidence, supporting inquiries, maintaining records, authenticating communications and administering the Board’s digital-office infrastructure. Rule 21 creates the legal basis for that supporting workforce.
The Board determines what staffing it considers necessary for efficiently discharging its functions. This gives it an important institutional role in assessing the expertise, number and distribution of personnel required. However, the requirement of previous Central Government approval means that the Board cannot create or fill positions entirely on its own authority. Approval must precede the appointment, rather than being obtained retrospectively after the person has already entered service.
This creates a shared institutional arrangement. The Board identifies its functional requirements, while the Central Government exercises prior control over appointments. The arrangement enables oversight of public staffing and expenditure, but the approval process should not operate in a manner that leaves the Board without the personnel reasonably required to perform its statutory duties within the prescribed timelines.
The need for effective staffing is especially important because the Board is required to function as a digital office and may conduct proceedings involving complex legal, technical and evidentiary questions. Its effective operation may require personnel with experience in privacy law, regulatory procedure, cybersecurity, digital forensics, information technology, records management, consent systems, data governance, cloud infrastructure and administration. The Rule does not itself prescribe the number or exact designation of officials. Those matters depend on the Board’s assessed needs and the approval granted by the Central Government.
The Sixth Schedule provides the substantive service framework. Its principal staffing model is deputation. The Board may appoint officers and employees on deputation from the Central Government, a State Government, an autonomous body under governmental control, a statutory body or a public-sector enterprise. Such appointments must follow the Fundamental Rules and applicable Department of Personnel and Training guidelines, and the deputation period cannot exceed five years.
The deputation structure allows the Board to draw upon personnel who already possess governmental, regulatory, technical or administrative experience while retaining an institutional relationship with their parent organisation. The five-year ceiling prevents deputation from becoming an indefinite arrangement and requires the Board to plan for succession, renewal of expertise and continuity when deputed personnel return to their parent organisations.
At the same time, frequent rotation can create operational challenges. Data-protection inquiries may involve extensive technical records and institutional knowledge built over several years. The Board will therefore need effective documentation, case-management systems, transfer-of-charge procedures and knowledge-preservation controls so that the expiry of an officer’s deputation does not disrupt ongoing proceedings or result in loss of expertise.
The Sixth Schedule also permits the Board to receive or take officers or employees on deputation from the National Institute for Smart Government for a period not exceeding five years. For such personnel, salary and allowances may be guided by market standards, and the Board may determine the other applicable terms. This provides flexibility to obtain specialised digital and technical capability that may not be readily available through conventional governmental deputation.
The ability to use market-guided compensation is particularly relevant to the Board’s digital-office mandate. Administrators of regulatory proceedings may be available within conventional government services, but specialised professionals in areas such as cybersecurity, cloud architecture, digital case management, forensic analysis or complex data systems may command compensation reflecting the wider technology market.
This flexibility does not remove the requirement of prior Central Government approval under Rule 21. Nor does it permit individual terms to be fixed without regard to public accountability, consistency or the limits of the Sixth Schedule. The Board must remain able to explain why the appointment is necessary, how the compensation was determined and how the person’s functions relate to the efficient discharge of the Board’s statutory responsibilities.
The Sixth Schedule also standardises the principal service benefits of the Board’s officers and employees. It recognises gratuity in accordance with the Payment of Gratuity Act, 1972, aligns travelling allowance with that applicable to Central Government officers and employees, and provides medical assistance through a Board group health insurance scheme approved by the Central Government. Leave is governed broadly by the Central Civil Services (Leave) Rules, 1972, including earned-leave encashment, while casual leave is aligned with Central Government instructions. Qualifying deputation personnel are also entitled to leave travel concession under the applicable Central Civil Services framework.
These provisions provide a familiar and relatively uniform service structure for personnel drawn from varied governmental and public institutions. They also distinguish the service framework of the Board’s officers and employees from that of its Chairperson and Members. The latter hold statutory offices on the remuneration and conditions prescribed by Rule 18 and the Fifth Schedule. Officers and employees form the Board’s administrative and professional establishment and are governed separately by Rule 21 and the Sixth Schedule.
The Sixth Schedule also applies the civil-service conduct framework to the Board’s personnel. This is significant because employees may have access to personal data, breach records, confidential submissions, commercially sensitive information, cybersecurity vulnerabilities, draft findings and material concerning ongoing inquiries. Conduct obligations support integrity, confidentiality, impartiality and appropriate use of official information.
The Board should also maintain clear internal separation between its Members and staff. Officers and employees may assist in investigation, legal research, technical analysis, administration and drafting. They do not acquire the statutory decision-making authority of the Chairperson or Members merely because they support a proceeding. Final findings, directions and orders must be made and authenticated in accordance with the Act and Rules.
This distinction is particularly important where technical personnel prepare reports or assess evidence. Their analysis may inform the Board, but the determination whether a contravention occurred, whether a direction should be issued or whether a penalty should be imposed remains with the legally authorised decision-maker.
Because the Board operates as a digital office, its staff will also be responsible for maintaining the reliability of electronic proceedings. Their functions may involve secure registration of cases, electronic service, access control, preservation of filings, management of virtual hearings, maintenance of audit trails and protection of the official record. Staffing decisions under Rule 21 must therefore account not only for the number of personnel but for the combination of legal, technical, administrative and security competencies needed to operate a credible digital regulator.
Officers and employees will themselves process significant volumes of personal data. Their access must therefore be governed by role-based permissions, confidentiality requirements, secure systems, monitoring and controlled retention. Appointment to the Board’s establishment does not justify unrestricted access to every complaint, breach report or technical record held by the Board. Access should correspond to the person’s assigned function.
The prior-approval requirement also has implications for institutional independence and accountability. Central Government supervision over appointments can promote expenditure control and consistency with public-service frameworks. At the same time, the Board must have sufficient operational capacity to conduct inquiries and meet statutory timelines. The approval process should therefore preserve governmental oversight without reducing the Board’s ability to secure necessary and suitably qualified personnel.
Rule 21 does not create employment rights for applicants to demand appointment merely because the Board requires particular expertise. Appointment remains subject to the Board’s determination of necessity, prior Central Government approval, the Sixth Schedule, applicable deputation rules and the terms of the particular selection or deputation process.
Nor does the Rule authorise permanent appointment through methods outside the Sixth Schedule merely because such an arrangement would be convenient. The Schedule provides the governing service framework and must be followed unless amended or supplemented through lawful authority.
Overall, Rule 21 establishes a controlled but flexible personnel system for the Data Protection Board. The Board identifies the officers and employees necessary for effective performance, while the Central Government retains prior approval over appointments. The Sixth Schedule then supplies a structured deputation-based model, permits access to specialised NISG personnel on market-guided terms and aligns the principal benefits and conduct obligations with established public-service frameworks.
The Rule’s institutional importance lies in the fact that enforcement capacity depends on staffing capacity. The Board may possess broad statutory powers, but those powers cannot be exercised effectively without personnel capable of managing digital proceedings, analysing technical evidence, protecting confidential information and supporting timely, fair and reasoned decisions. Rule 21 therefore provides the administrative foundation on which the Board’s practical functioning depends.