Section 18 - Establishment of Board

1.1 Detailed structured summary

Section 18 establishes the Data Protection Board of India as the statutory institution responsible for exercising the powers and performing the functions assigned to the Board under the Digital Personal Data Protection Act, 2023. The provision primarily deals with the Board’s legal creation, institutional identity, corporate status and headquarters. It does not itself specify the Board’s composition, enforcement powers, inquiry procedure or penalty jurisdiction, which are dealt with in subsequent sections of the Act.

Section 18 came into force on 13 November 2025. On that date, the Central Government formally established the Data Protection Board of India through G.S.R. 844(E) and notified that its head office would be situated in the National Capital Region of India.

2. Formal establishment of the Board

The Data Protection Board was not established automatically when the DPDPA was enacted on 11 August 2023. Section 18 required the Central Government to appoint the establishment date through a notification published in the Official Gazette.

The Central Government exercised this power on 13 November 2025. The notification formally established the Board:

“to exercise the powers conferred on, and to perform the functions assigned to it” under the DPDPA.

The notification is therefore the legal instrument that brought the Board into existence.

This distinction is important because three different events must not be confused:

1. Enactment of the DPDPA: 11 August 2023.

2. Commencement of Section 18: 13 November 2025.

3. Formal establishment of the Board: 13 November 2025.

The establishment of the Board also does not mean that every substantive provision of the DPDPA became operational on the same date. Most processing obligations, Data Principal rights, complaint provisions, inquiry powers and penalty provisions are scheduled to commence on 13 May 2027. The Board was established earlier so that its institutional structure could be constituted before the substantive enforcement framework becomes fully operational.

3. Purpose and jurisdiction of the Board

The Board is established specifically “for the purposes of this Act.”

This means that its authority is confined to the powers and functions assigned under the DPDPA. It is not a general regulator for every matter involving:

• digital information;

• cybersecurity;

• artificial intelligence;

• online content;

• consumer disputes;

• contractual confidentiality;

• technology services.

Section 18 establishes the institution but does not itself confer the Board’s substantive enforcement powers.

The Board’s authority to deal with matters such as:

• personal data breaches;

• complaints;

• inquiries into non-compliance;

• interim directions;

• voluntary undertakings;

• monetary penalties;

must be traced to later provisions, principally Sections 27 and 28 and the corresponding Rules.

Accordingly, Section 18 should be understood as the Board’s constitutive provision, not as the complete source of its enforcement jurisdiction.

4. One national Data Protection Board

Section 18 establishes one central institution called the Data Protection Board of India.

It does not establish:

• separate State Data Protection Boards;

• regional privacy authorities;

• independent sector-specific data protection boards;

• multiple legally separate boards.

The Board may function through Members, benches or other procedural arrangements permitted by the Act, but those arrangements remain part of the same statutory body.

Its head office is located in the National Capital Region, but its statutory authority is not geographically limited to the NCR. Its jurisdiction follows the application of the DPDPA, not the physical location of its headquarters.

5. The Board as a body corporate

Section 18 gives the Board the status of a body corporate.

This means that the Board has a legal identity separate from:

• the Central Government;

• the Ministry of Electronics and Information Technology;

• its Chairperson;

• individual Members;

• its officers and employees.

The Board can therefore hold rights, incur obligations, enter contracts, hold property and participate in legal proceedings in its own statutory name.

Body-corporate status also means that the Board is not merely an internal advisory committee within MeitY. It is a distinct statutory institution created by Parliament.

However, separate corporate personality should not be confused with complete institutional independence in every respect. The Central Government continues to perform the functions assigned to it under the Act, including:

• appointing the Chairperson and Members;

• prescribing service conditions;

• notifying the headquarters;

• making Rules;

• providing administrative arrangements.

The institutional relationship between the Board and the Central Government must therefore be understood from the DPDPA as a whole, rather than from the expression “body corporate” alone.

6. Perpetual succession

The Board has perpetual succession.

This ensures that its legal existence continues despite changes in its Chairperson, Members or personnel.

The Board does not cease to exist merely because:

• a Chairperson’s term expires;

• a Member resigns;

• a Member dies;

• a position becomes vacant;

• new Members are appointed;

• the composition of the Board changes.

Perpetual succession preserves the continuity of:

• institutional property;

• contracts;

• records;

• legal proceedings;

• rights and obligations.

A change in office-holder therefore does not create a new Board. The institution remains the same statutory body.

This concept must be distinguished from the validity of particular proceedings when a vacancy exists. Perpetual succession preserves the Board’s legal existence. The validity of specific proceedings is governed by the provisions dealing with Board procedure.

7. Common seal

Section 18 provides that the Board shall have a common seal.

The common seal represents the corporate identity of the Board and may be used to authenticate institutional documents where the applicable procedure requires it.

Section 18 does not specify:

• the form or design of the seal;

• the person authorised to use it;

• the documents on which it must appear;

• the manner in which it must be kept.

The reference to a common seal also does not mean that every electronic order or communication must carry a physical seal. The Board is intended to operate as a digital institution, and the validity of electronic orders or communications will depend on the applicable procedural and authentication requirements.

8. Power to acquire, hold and dispose of property

The Board may acquire, hold and dispose of both movable and immovable property.

This allows it to possess the assets required for institutional functioning, such as:

• office premises;

• computer systems;

• equipment;

• technological infrastructure;

• administrative assets.

The property belongs to the Board as a statutory body. It does not belong personally to the Chairperson, Members or officers.

The Board’s property powers remain expressly subject to the DPDPA. They must also be exercised consistently with applicable public financial, procurement and administrative requirements.

The provision gives the Board legal capacity to deal with property. It does not prescribe the particular procedures through which property must be acquired or disposed of.

9. Power to enter contracts

The Board may enter contracts in its own name.

This enables it to obtain the services, technology, premises and infrastructure required to perform its statutory functions.

Example

For example, the Board may enter contracts relating to:

• digital filing systems;

• technology infrastructure;

• office facilities;

• professional support;

• equipment;

• administrative services.

The contracting power does not permit the Board to transfer statutory adjudicatory authority to a private contractor.

A technology provider may operate the Board’s electronic platform, but it cannot exercise powers reserved to the Board, Chairperson or Members, such as:

• deciding complaints;

• conducting statutory adjudication;

• imposing penalties;

• issuing orders.

The Board may contract for operational support, but it cannot contract out of its statutory responsibilities.

10. Capacity to sue and be sued

The Board may sue or be sued in its own statutory name.

This follows from its separate corporate personality.

It may therefore:

• institute legal proceedings where lawfully required;

• defend proceedings;

• enforce contractual rights;

• respond to claims;

• participate in proceedings concerning its property or statutory actions.

The phrase “sue or be sued” gives the Board legal capacity to participate in litigation. It does not create an unrestricted new cause of action against the Board.

It also does not permit the statutory appeal mechanism to be bypassed. Where a person wishes to challenge an order of the Board, the appeal must be pursued through the mechanism prescribed in Section 29.

The general capacity to be sued does not replace the specific remedy Parliament has provided against Board orders.

11. Headquarters of the Board

Section 18(3) authorises the Central Government to notify the place at which the Board’s headquarters will be situated.

The establishment notification dated 13 November 2025 provides that the Board’s head office shall be in the National Capital Region of India.

The notification identifies the region rather than a specific permanent building or street address.

The location of the head office serves an institutional and administrative purpose. It does not mean:

• the Board’s jurisdiction is limited to the NCR;

• every complaint must be filed physically in the NCR;

• every hearing must take place physically at the head office;

• Data Principals outside the NCR must travel there.

The Board is intended to operate through a digital-office framework, allowing proceedings to be conducted through online or digital mechanisms. The notified head office and its digital functioning are therefore compatible.

11.1 Relationship with Rule 17

Rule 17 is relevant to the functioning of the Board, but it does not establish the Board.

Section 18 and the establishment notification create the legal institution.

Rule 17 provides the mechanism for recommending and appointing the individuals who will serve as:

• Chairperson; and

• Members other than the Chairperson.

The distinction is important:

SECTION 18

Creates the Data Protection Board of India as a statutory body corporate

RULE 17

Creates the Search-cum-Selection process for appointment of the Chairperson and Members

12. Selection of the Chairperson

Rule 17 requires the Central Government to constitute a Search-cum-Selection Committee for recommending individuals for appointment as Chairperson.

The Committee consists of:

• the Cabinet Secretary, who chairs the Committee;

• the Secretary to the Government of India in charge of the Department of Legal Affairs;

• the Secretary to the Government of India in MeitY;

• two experts of repute.

The experts must have special knowledge or practical experience in a field that, in the Central Government’s opinion, may be useful to the Board.

The Rule does not prescribe a closed list of fields or qualifications for these expert Committee members.

The Committee’s role is limited to recommending individuals. It does not itself appoint the Chairperson.

13. Selection of other Members

A separate Search-cum-Selection Committee recommends candidates for appointment as Members other than the Chairperson.

This Committee consists of:

• the Secretary in MeitY, who serves as chairperson;

• the Secretary in charge of the Department of Legal Affairs;

• two experts of repute with relevant knowledge or practical experience.

The principal distinction between the two Committees is their chairing arrangement:

• the Cabinet Secretary chairs the Committee for the Chairperson;

• the MeitY Secretary chairs the Committee for other Members.

The Committee members do not become Members of the Data Protection Board merely by participating in the selection process.

14. Appointment by the Central Government

The Search-cum-Selection Committees recommend candidates, but the Central Government makes the appointments.

After receiving the recommendations, the Central Government must consider the suitability of the recommended individuals and appoint the Chairperson or Member, as applicable.

Recommendation and appointment are therefore legally distinct stages.

An individual does not become Chairperson or Member merely because:

• she applied for the position;

• she was shortlisted;

• the Committee recommended her;

• she participated in an interview.

A formal appointment by the Central Government is required.

The appointment must also comply with the qualifications and disqualifications prescribed under the Act.

15. Vacancy, absence or defect in a Search-cum-Selection Committee

Rule 17 provides that an act or proceeding of a Search-cum-Selection Committee cannot be questioned merely because of:

• a vacancy;

• an absence;

• a defect in the Committee’s constitution.

This provision prevents the selection process from automatically becoming invalid because of a technical defect in Committee composition.

The word “merely” is important. The Rule does not make the selection process immune from every legal challenge.

It does not validate:

• fraud;

• bad faith;

• appointment of an ineligible or disqualified person;

• complete abandonment of the prescribed process;

• action taken without statutory authority.

The protection also applies to the Search-cum-Selection Committee, not to vacancies within the Data Protection Board itself.

15.1 Present institutional position

The relevant legal developments are:

1. The DPDPA was enacted on 11 August 2023.

2. Sections 18 to 26 came into force on 13 November 2025.

3. The Data Protection Board of India was formally established on 13 November 2025.

4. Its head office was notified for the National Capital Region of India.

5. Government recruitment materials issued in 2026 invited applications for one Chairperson and four other Members. That current composition arises from the applicable governmental decision and appointment process, not from Section 18 itself.

6. Most substantive processing obligations and enforcement provisions are scheduled to commence on 13 May 2027.

Conclusion

Section 18 creates the institutional foundation of the DPDPA enforcement framework.

It establishes the Data Protection Board of India as a national statutory body corporate with:

• separate legal personality;

• perpetual succession;

• a common seal;

• property-holding capacity;

• contracting capacity;

• capacity to sue and be sued.

The Board’s head office is situated in the National Capital Region, but its jurisdiction is not confined to that region.

Section 18 does not itself set out the Board’s composition, qualifications, inquiry procedure or enforcement powers. Those matters are governed by subsequent provisions of the Act and the Rules.

Rule 17 complements Section 18 by establishing the Search-cum-Selection process for the Chairperson and other Members. The Committees recommend suitable candidates, but the Central Government remains the appointing authority.

Key point

In substance, Section 18 creates the Data Protection Board of India as a continuing legal institution, while Rule 17 provides the process for constituting its decision-making membership.