Data Protection Board Setup Underway, IT Secretary Confirms
The Indian government has begun establishing the Data Protection Board under the Digital Personal Data Protection Act. IT Secretary S Krishnan announced that the process for appointing board members is underway, with two separate search-cum-selection committees overseeing nominations. The government has also completed the development of software infrastructure for the board's fully online operations. Consultations with industry stakeholders are ongoing to assess readiness for compliance timelines. The board will have significant enforcement powers, including the ability to impose hefty financial penalties for violations.
*this image is generated using AI for illustrative purposes only.
The Indian government has begun establishing the framework for the new Data Protection Board under the Digital Personal Data Protection Act, with IT Secretary S Krishnan announcing that groundwork for member appointments is actively underway. The government has also completed development of the requisite software infrastructure to support a fully online office for the regulatory body.
Board Establishment Progress
The appointment process involves a structured selection mechanism as outlined in the recently notified DPDP Rules. Two separate search-cum-selection committees will oversee the nomination process:
| Committee Role | Chairperson | Members |
|---|---|---|
| Board Chairperson Selection | Cabinet Secretary | Law Secretary, IT Secretary, Two Domain Experts |
| Board Members Selection | IT Secretary | Law Secretary, Two Domain Experts |
"On data protection board, we've started the process of putting in place the way to identify members and call for their nomination to put them in the positions and posts which the board would need…we are working on that right now, because we have to get it approved," Krishnan stated during an interview.
Technical Infrastructure Ready
The government has completed development of software required for the Data Protection Board's completely online operations. This digital infrastructure will enable the board to function efficiently once operational. Krishnan indicated that the board is expected to be "up and running in the coming months," though he declined to provide a specific timeline for the launch.
Industry Consultation on Compliance
Regarding potential adjustments to compliance timelines for large technology companies, the IT Secretary confirmed ongoing consultations with industry stakeholders. The government is assessing corporate preparedness levels before finalizing implementation schedules.
"We've asked them to tell us when they will be ready and look at specific aspects….because please understand it's complex," Krishnan explained. He noted that companies have not indicated discomfort with any particular aspect during discussions, emphasizing the government's priority to avoid disruption to the digital ecosystem.
Regulatory Framework and Penalties
The Data Protection Board will operate as an independent body with significant enforcement powers under the DPDP Act. Its responsibilities include monitoring compliance, investigating data breaches, and imposing financial penalties for violations.
| Violation Type | Maximum Penalty |
|---|---|
| Failure to maintain security safeguards | ₹250.00 crores |
| Not notifying breaches/children's data violations | ₹200.00 crores each |
| Other DPDP Act violations | ₹50.00 crores |
The Act establishes a comprehensive framework balancing individual data protection rights with legitimate business processing needs. Data Fiduciaries must maintain reasonable security safeguards and remain accountable for data usage, while Data Principals receive rights regarding how their personal information is handled.
Implementation Timeline
The Digital Personal Data Protection Act aims to create a robust framework for processing digital personal data while recognizing both individual privacy rights and lawful business requirements. The establishment of the Data Protection Board represents a crucial step in operationalizing India's comprehensive data protection regime, with the government working to ensure smooth implementation across the digital ecosystem.
20
