India DPDPA: Article 18 – Establishment of the Board
18. Establishment of the Board
(1) With effect from such date as the Central Government may, by notification, appoint, there shall be established, for the purposes of this Act, a Board to be called the Data Protection Board of India.
(2) The Board shall be a body corporate by the name aforesaid, having perpetual succession and a common seal, with power, subject to the provisions of this Act, to acquire, hold and dispose of property, both movable and immovable, and to contract and shall, by the said name, sue or be sued.
(3) The headquarters of the Board shall be at such place as the Central Government may notify.
What Article 18 Means for Your Business
Article 18 establishes the Data Protection Board of India (DPBI) as the statutory body responsible for enforcing the DPDPA. The Board is the regulatory authority to which Data Principals can bring complaints, and which can investigate breaches and impose penalties on Data Fiduciaries.
- The Data Protection Board of India is now established and operational, it is the primary enforcement authority under the DPDPA.
- The Board operates as a digital-first body, complaints, notices, and proceedings are conducted electronically where possible.
- Businesses should familiarise themselves with the Board’s procedures for receiving and handling complaints, as these affect how you must respond to Board inquiries.
- The Board has the power to direct urgent remedial action in the event of a data breach, non-compliance with Board directions carries significant penalty risk.