DPDP Rules: MeitY establishes Data Protection Board, head office to be in NCR, will comprise 4 members

India on November 14 released the rules for the DPDP Act

With the release of the rules for Digital Personal Data Protection (DPDP) Act, the Ministry of Electronics and Information Technology (MeitY), in two separate notifications on November 14, announced the establishment of the Data Protection Board and said that it will comprise of four members.

The Data Protection Board is the adjudicatory body established under the DPDP Act to enforce the law, inquire into data breaches and impose penalties. Under the DPDP Rules, 2025, the Board’s structure, appointment process, service conditions are formally laid out.

The rules also say that the chairperson of the board will be paid a salary of Rs 4.5 lakh per month, and other members, Rs 4 lakh per month.

"In exercise of the powers conferred by sub-sections (1) and (3) of section 18 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby establishes, the Data Protection Board of India, to exercise the powers conferred on, and to perform the functions assigned to it under the said Act, with effect from the date of publication of this notification in the Official Gazette. The head office of the Data Protection Board of India shall be in the National Capital Region of India," one of the notification read.

The draft rules were released for consultation on January 2025. It was announced on November 14, following extensive rounds of consultation. The rules effectively operationalise the DPDP Act, which was passed in the Parliament on August 2023.