What Is the Data Protection Board of India (DPBI)?
India's statutory DPDPA enforcement authority: what it does, what it can penalise, and how to prepare.
The Central Government established the Board on 13 November 2025 under Section 18 of the DPDPA. It has four members, and its head office is in the National Capital Region (NCR).
For businesses, this means privacy compliance now needs proof. Be ready to show how you give notice, collect and manage consent, honour Data Principal rights, and protect personal data. Consent records are often the first evidence you will need.
How the Data Protection Board Protects Data Principals' Privacy
The Board is where privacy rights turn into enforcement. The DPDPA gives every Data Principal rights, such as receiving a clear notice, giving or withdrawing consent, and having grievances handled. The Board is the body that can act when a Data Fiduciary fails to respect them.
If a complaint or breach comes before the Board, it can inquire into what happened, decide whether the Act was broken, and impose a penalty where the law allows. For example, if a company keeps tracking a visitor after they withdrew consent, the Board can look at whether the company's records and practices match what it promised.
For people, this means their privacy rights have an authority behind them. For businesses, it means a privacy policy is not enough. You need to show what actually happened to each person's data, which is why consent records and audit evidence matter.
What is the DPBI responsible for?
The Data Protection Board's responsibilities include functions such as:
- Inquiring into non-compliance with the DPDPA
- Considering matters and complaints that fall within its statutory remit
- Determining whether obligations under the Act have been breached
- Imposing penalties where authorised by the Act
- Exercising other functions assigned under the DPDPA and applicable rules
The Board is therefore different from a company's internal privacy team or a Consent Management Platform (CMP). A CMP helps an organisation operationalise consent; the Data Protection Board is a statutory enforcement authority.
When was the Data Protection Board of India established?
The Central Government established the Data Protection Board of India on 13 November 2025 through an official notification under Section 18 of the DPDPA. The notification states that the Board would exercise the powers and perform the functions assigned to it under the Act.
A separate notification issued on the same date specified that the Board would consist of four members.
This makes the Data Protection Board an important part of India's operational data-protection framework, alongside the DPDPA and the Digital Personal Data Protection Rules, 2025. Unlike the GDPR, where each EU member state has its own supervisory authority, the DPDPA gives enforcement to a single national Board.
What is the role of the Data Protection Board under the DPDPA?
The DPDPA establishes the Board as its enforcement mechanism.
For a Data Fiduciary, this means compliance should not be treated simply as a privacy-policy exercise. An organisation may need to demonstrate that its actual data-processing practices match the obligations described in its notices, consent flows and internal procedures.
Depending on the obligation involved, evidence may include:
- The privacy notice shown to a Data Principal
- The purposes for which consent was requested
- The consent or refusal recorded
- The date and time of the decision
- The version of the notice or consent language presented
- Records of consent withdrawal
- Records showing how withdrawal affected processing
- Data Principal rights and grievance records
- Evidence of security and compliance controls
- Records relating to children's data where applicable
Can the Data Protection Board impose penalties?
Yes. The DPDPA gives the Data Protection Board enforcement and penalty-related powers.
The Act provides for significant financial penalties for specified breaches, with the maximum penalty reaching ₹250 crore for certain violations.
The exact penalty depends on the nature and circumstances of the relevant breach rather than every DPDPA violation automatically resulting in the maximum amount.
For businesses, the practical lesson is straightforward: DPDPA compliance should be demonstrable, not merely claimed.
Data Protection Board vs DPDPA
The DPDPA and the Data Protection Board are not the same thing.
| DPDPA | Data Protection Board |
|---|---|
| India's digital personal data protection law | Enforcement body established under the DPDPA |
| Defines obligations and rights | Exercises powers and functions assigned by the Act |
| Applies rules to Data Fiduciaries and Data Principals | Handles enforcement matters within its statutory remit |
| Establishes data-protection requirements | Can determine non-compliance and impose applicable penalties |
| Passed as legislation | Established by government notification under the Act |
A simple way to remember the distinction is:
The DPDPA sets the rules. The Data Protection Board helps enforce them.
Data Protection Board vs Data Protection Officer
The Data Protection Board should not be confused with a Data Protection Officer (DPO).
A Data Protection Officer is an organisational role. Certain Significant Data Fiduciaries are subject to additional requirements, including DPO-related obligations.
The Data Protection Board, by contrast, is an external statutory authority established under the DPDPA.
In simple terms:
DPO
Works for or represents an organisation in its privacy and data-protection function.
Data Protection Board
Is the statutory authority responsible for enforcement under the DPDPA.
Data Protection Board and Data Fiduciaries
Under the DPDPA, a Data Fiduciary is the entity that determines the purpose and means of processing personal data.
Data Fiduciaries are responsible for meeting their obligations under the Act. If compliance becomes subject to regulatory scrutiny, an organisation should be able to demonstrate how it handles personal data and how it meets applicable DPDPA requirements.
This is especially relevant to consent.
If an organisation relies on consent, it should be able to establish:
- What information was presented to the Data Principal.
- What purpose or purposes were specified.
- What consent the Data Principal provided.
- When the consent was provided.
- How consent could be withdrawn.
- What happened after withdrawal.
- Which version of the relevant notice or consent language applied.
This is why reliable consent records are an important part of a DPDPA compliance programme.
Data Protection Board and consent records
A consent record is evidence of a user's decision.
For example, a useful consent record can associate a decision with:
- A Data Principal or appropriate pseudonymous identifier
- The purposes presented
- The consent status
- Timestamp
- Notice or policy version
- Relevant jurisdiction or regulatory framework
- Withdrawal information
- A tamper-evident integrity mechanism
A consent receipt can provide a structured record of what a person agreed to and when.
For organisations subject to DPDPA requirements, maintaining reliable evidence can make it substantially easier to demonstrate that consent processes were actually implemented rather than simply described in a policy.
Why does the Data Protection Board matter for businesses?
The establishment of the Board changes the practical compliance environment for organisations processing digital personal data in India.
Businesses should think beyond:
“Do we have a privacy policy?”
A stronger compliance question is:
“Can we demonstrate that our data-processing and consent practices actually followed the requirements?”
That can involve implementing controls for:
- Clear and itemised notices
- Purpose-based consent
- Consent withdrawal
- Children's data
- Data Principal rights
- Grievance handling
- Security safeguards
- Consent records
- Processor management
- Regulatory evidence
ConsentX focuses particularly on the consent and evidence layer of this broader compliance framework.
Data Protection Board and consent management
A Consent Management Platform (CMP) is not the Data Protection Board.
A CMP helps a business collect, store and enforce user choices. For example, a CMP can present a consent interface, block non-essential trackers until the appropriate choice is made, record consent, and enforce withdrawal.
The Data Protection Board performs a completely different function: it is the statutory authority established under the DPDPA.
Therefore:
CMP
Compliance technology
Data Protection Board
Statutory enforcement authority
This distinction is important when evaluating DPDPA compliance tools.
What evidence should businesses keep for DPDPA compliance?
Organisations should consider maintaining auditable records relevant to the processing activities they conduct.
Depending on the organisation and processing activity, this can include:
Consent evidence
Records showing what the Data Principal consented to, when consent was given, and the purposes covered.
Notice evidence
Records showing the notice or information presented when consent was collected.
Withdrawal evidence
Records showing when consent was withdrawn and how the organisation responded.
Rights and grievance evidence
Records demonstrating how Data Principal requests and grievances were received, processed and resolved.
Children's data evidence
Where applicable, evidence supporting age verification and verifiable parental consent processes.
Security and incident evidence
Documentation demonstrating the security safeguards and response processes applicable to the organisation.
A well-designed compliance system should make this evidence accessible without requiring teams to reconstruct events manually.
Data Protection Board and the DPDP Rules 2025: What Applies and When
The Board sits inside a larger legal framework. The DPDPA sets the rights and duties, the Digital Personal Data Protection Rules, 2025 (notified in November 2025) explain how they work in practice, and the Board enforces both. The Central Government set up the Board through a Section 18 notification on 13 November 2025, and a second notification fixed its membership at four members. Both notifications are published by the Ministry of Electronics and Information Technology (MeitY). Section 18 Board Establishment Notification and Board Composition Notification.
Not every rule applies at once. The DPDPA is being phased in, so different obligations start on different dates. The table below gives a simple overview.
What this means for you: the Board already exists, so the time to prepare is before the main obligations start. Start with your consent notices and records, then check your DPDPA compliance position across notice, withdrawal, rights requests and security.
How ConsentX Helps You Prove DPDPA Compliance
p1
p2
c1
c2
c3
c4
c5
c6
c7
ConsentX turns DPDPA consent requirements into proof you can show. Each visitor's choice is recorded against the purpose it covers, with the time and the version of the notice they saw. Non-essential trackers stay blocked until the visitor agrees, and if they withdraw later, processing stops. If the Data Protection Board ever asks how you handled consent, the record is already there.
Each decision is saved as a consent receipt, a tamper-evident record that shows what the person agreed to and when. You can find it without rebuilding events by hand.
Data Protection Board of India: Key Takeaways
The Data Protection Board of India is the statutory enforcement body created under the DPDPA.
The most important points are:
- The Board was established under Section 18 of the DPDPA.
- It was formally established by notification on 13 November 2025.
- Its head office is in the National Capital Region.
- It has powers and functions assigned under the DPDPA.
- It can determine non-compliance and impose applicable penalties.
- DPDPA penalties can reach ₹250 crore for specified violations.
- Data Fiduciaries should be able to demonstrate compliance.
- Consent records can provide important evidence where processing relies on consent.
- A Data Protection Board is different from a Consent Management Platform.
- A DPO and the Data Protection Board are also different roles.
As India's data-protection framework moves into implementation, maintaining clear, accurate and auditable compliance records becomes increasingly important.
Be Ready Before the Board Asks
Compliance is stronger when you can show what happened, not just say it happened. See how ConsentX records, enforces and stores consent proof across your website.
Related Terms
India's Digital Personal Data Protection Act, 2023 and the foundation of India's digital personal data protection framework.
The entity that determines the purpose and means of processing personal data under the DPDPA.
The individual to whom the personal data relates.
A registered intermediary model under the DPDPA through which Data Principals can give, manage, review and withdraw consent.
Technology used by organisations to collect, manage, enforce and document consent.
A record of a user's consent decision, including relevant information such as purposes, timing and applicable notice or policy version.
The policies, processes, controls and technical measures an organisation uses to meet its obligations under India's data-protection framework.