ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXIndia's statutory DPDPA enforcement authority: what it does, what it can penalise, and how to prepare.
The Central Government established the Board on 13 November 2025 under Section 18 of the DPDPA. It has four members, and its head office is in the National Capital Region (NCR).
For businesses, this means privacy compliance now needs proof. Be ready to show how you give notice, collect and manage consent, honour Data Principal rights, and protect personal data. Consent records are often the first evidence you will need.
The Data Protection Board's responsibilities include functions such as:
The Board is therefore different from a company's internal privacy team or a Consent Management Platform (CMP). A CMP helps an organisation operationalise consent; the Data Protection Board is a statutory enforcement authority.
The DPDPA establishes the Board as its enforcement mechanism.
For a Data Fiduciary, this means compliance should not be treated simply as a privacy-policy exercise. An organisation may need to demonstrate that its actual data-processing practices match the obligations described in its notices, consent flows and internal procedures.
Depending on the obligation involved, evidence may include:
The Central Government established the Data Protection Board of India on 13 November 2025 through an official notification under Section 18 of the DPDPA. The notification states that the Board would exercise the powers and perform the functions assigned to it under the Act.
A separate notification issued on the same date specified that the Board would consist of four members.
This makes the Data Protection Board an important part of India's operational data-protection framework, alongside the DPDPA and the Digital Personal Data Protection Rules, 2025. Unlike the GDPR, where each EU member state has its own supervisory authority, the DPDPA gives enforcement to a single national Board.
Yes. The DPDPA gives the Data Protection Board enforcement and penalty-related powers.
The Act provides for significant financial penalties for specified breaches, with the maximum penalty reaching ₹250 crore for certain violations.
The exact penalty depends on the nature and circumstances of the relevant breach rather than every DPDPA violation automatically resulting in the maximum amount.
For businesses, the practical lesson is straightforward: DPDPA compliance should be demonstrable, not merely claimed.
The DPDPA and the Data Protection Board are not the same thing.
| DPDPA | Data Protection Board |
|---|---|
| India's digital personal data protection law | Enforcement body established under the DPDPA |
| Defines obligations and rights | Exercises powers and functions assigned by the Act |
| Applies rules to Data Fiduciaries and Data Principals | Handles enforcement matters within its statutory remit |
| Establishes data-protection requirements | Can determine non-compliance and impose applicable penalties |
| Passed as legislation | Established by government notification under the Act |
A simple way to remember the distinction is:
The DPDPA sets the rules. The Data Protection Board helps enforce them.
The Data Protection Board should not be confused with a Data Protection Officer (DPO).
A Data Protection Officer is an organisational role. Certain Significant Data Fiduciaries are subject to additional requirements, including DPO-related obligations.
The Data Protection Board, by contrast, is an external statutory authority established under the DPDPA.
In simple terms:
DPO
Works for or represents an organisation in its privacy and data-protection function.
Data Protection Board
Is the statutory authority responsible for enforcement under the DPDPA.
A Consent Management Platform (CMP) is not the Data Protection Board.
A CMP helps a business collect, store and enforce user choices. For example, a CMP can present a consent interface, block non-essential trackers until the appropriate choice is made, record consent, and enforce withdrawal.
The Data Protection Board performs a completely different function: it is the statutory authority established under the DPDPA.
Therefore:
CMP
Compliance technology
Data Protection Board
Statutory enforcement authority
This distinction is important when evaluating DPDPA compliance tools.
The Board is where privacy rights turn into enforcement. The DPDPA gives every Data Principal rights, such as receiving a clear notice, giving or withdrawing consent, and having grievances handled. The Board is the body that can act when a Data Fiduciary fails to respect them.
If a complaint or breach comes before the Board, it can inquire into what happened, decide whether the Act was broken, and impose a penalty where the law allows. For example, if a company keeps tracking a visitor after they withdrew consent, the Board can look at whether the company's records and practices match what it promised.
For people, this means their privacy rights have an authority behind them. For businesses, it means a privacy policy is not enough. You need to show what actually happened to each person's data, which is why consent records and audit evidence matter.
The establishment of the Board changes the practical compliance environment for organisations processing digital personal data in India.
Businesses should think beyond:
“Do we have a privacy policy?”
A stronger compliance question is:
“Can we demonstrate that our data-processing and consent practices actually followed the requirements?”
That can involve implementing controls for:
ConsentX focuses particularly on the consent and evidence layer of this broader compliance framework.
The Board sits inside a larger legal framework. The DPDPA sets the rights and duties, the Digital Personal Data Protection Rules, 2025 (notified in November 2025) explain how they work in practice, and the Board enforces both. The Central Government set up the Board through a Section 18 notification on 13 November 2025, and a second notification fixed its membership at four members. Both notifications are published by the Ministry of Electronics and Information Technology (MeitY). Section 18 Board Establishment Notification and Board Composition Notification.
Not every rule applies at once. The DPDPA is being phased in, so different obligations start on different dates. The table below gives a simple overview.
| Provision | What it covers | When it applies |
|---|---|---|
| Board and definitions | Setting up the Board | From 13 Nov 2025 |
| Consent Manager rules | Registration and duties of Consent Managers | About 12 months after notification |
| Main obligations | Notice, consent, Data Principal rights, security, children's data | About 18 months after notification |
What this means for you: the Board already exists, so the time to prepare is before the main obligations start. Start with your consent notices and records, then check your DPDPA compliance position across notice, withdrawal, rights requests and security.
Organisations should consider maintaining auditable records relevant to the processing activities they conduct.
Depending on the organisation and processing activity, this can include:
Records showing what the Data Principal consented to, when consent was given, and the purposes covered.
Records showing the notice or information presented when consent was collected.
Records showing when consent was withdrawn and how the organisation responded.
Records demonstrating how Data Principal requests and grievances were received, processed and resolved.
Where applicable, evidence supporting age verification and verifiable parental consent processes.
Documentation demonstrating the security safeguards and response processes applicable to the organisation.
A well-designed compliance system should make this evidence accessible without requiring teams to reconstruct events manually.
Under the DPDPA, a Data Fiduciary is the entity that determines the purpose and means of processing personal data.
Data Fiduciaries are responsible for meeting their obligations under the Act. If compliance becomes subject to regulatory scrutiny, an organisation should be able to demonstrate how it handles personal data and how it meets applicable DPDPA requirements.
This is especially relevant to consent.
If an organisation relies on consent, it should be able to establish:
This is why reliable consent records are an important part of a DPDPA compliance programme.
A consent record is evidence of a user's decision.
For example, a useful consent record can associate a decision with:
A consent receipt can provide a structured record of what a person agreed to and when.
For organisations subject to DPDPA requirements, maintaining reliable evidence can make it substantially easier to demonstrate that consent processes were actually implemented rather than simply described in a policy.
If the Data Protection Board asks how you handled consent, you need records, not just a policy. ConsentX helps you collect, enforce and keep that proof.
ConsentX turns DPDPA consent requirements into proof you can show. Each visitor's choice is recorded against the purpose it covers, with the time and the version of the notice they saw. Non-essential trackers stay blocked until the visitor agrees, and if they withdraw later, processing stops. If the Data Protection Board ever asks how you handled consent, the record is already there.
Each decision is saved as a consent receipt, a tamper-evident record that shows what the person agreed to and when. You can find it without rebuilding events by hand.
ConsentX covers the consent and evidence part of DPDPA compliance. It does not replace legal advice or your wider obligations, such as security safeguards and grievance handling.
The Data Protection Board of India is the statutory enforcement body created under the DPDPA.
The most important points are:
As India's data-protection framework moves into implementation, maintaining clear, accurate and auditable compliance records becomes increasingly important.
Compliance is stronger when you can show what happened, not just say it happened. See how ConsentX records, enforces and stores consent proof across your website.
Related Terms
India's Digital Personal Data Protection Act, 2023 and the foundation of India's digital personal data protection framework.
The entity that determines the purpose and means of processing personal data under the DPDPA.
The individual to whom the personal data relates.
A registered intermediary model under the DPDPA through which Data Principals can give, manage, review and withdraw consent.
Technology used by organisations to collect, manage, enforce and document consent.
A record of a user's consent decision, including relevant information such as purposes, timing and applicable notice or policy version.
Explore ConsentX