Make Data Protection Board active in 8 weeks, HC tells Centre

Why in news?

Kerala HC directed the Centre to make the Data Protection Board under the DPDP Act functional within eight weeks.

UPSC Relevance 

Prelims: DPDP Act 2023, Data Protection Board, DPDP Rules 2025

Mains: GS2 – Fundamental Rights (right to privacy), Statutory and regulatory bodies, Government policies and interventions. 

GS3 – Cyber security.

Data Protection Board of India 

• Establishment : Set up under the Section 18 of the Digital Personal Data Protection Act, 2023.
  • Set up by the Central Government as a body corporate, with perpetual succession and a common seal.
• Composition (Section 19): A Chairperson and such number of Members as the Centre notifies, all appointed by the Central Government. Members must have special knowledge in fields like data governance, dispute resolution, ICT, digital economy, law or consumer protection; at least one must be an expert in law.
• Selection (DPDP Rules, 2025): Appointments are made on the recommendation of a search-cum-selection committee headed by the Cabinet Secretary.
• Term (Section 20): Two years, with eligibility for reappointment. Salary and service conditions are set by the Centre.
• Functions (Section 27):
  • Direct urgent measures to contain a personal data breach and reduce harm.
  • Inquire into breaches and complaints by Data Principals, or matters referred by the Centre, a State or a court.
  • Impose penalties for violations of the Act.
  • Inquire into breaches by Consent Managers and suspend or cancel their registration.
• Procedure (Section 28): Works as an independent body and as a ‘digital office’, with complaints, hearings and orders handled online. It has powers of a civil court for summoning people, examining them on oath and inspecting documents.
• Mediation and settlement: May refer disputes to mediation (Section 31) and may accept a voluntary undertaking from a company, which then bars further proceedings on that matter (Section 32).
• Penalties (Section 33 and Schedule):
  • Up to ₹250 crore for failure to take reasonable security safeguards.
  • Up to ₹200 crore each for failure to notify a breach and for violating obligations on children’s data.
  • Up to ₹10,000 for breach of duties by individuals. 
  • Penalties go to the Consolidated Fund of India (Section 34), not to the affected person.
• Appeals (Section 29): Lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days; further appeal to the Supreme Court.
• Blocking (Section 37): If a company is penalised in two or more cases, the Board can advise the Centre to block public access to its platform in India.
• Bar on civil courts (Section 39): No civil court can hear matters falling under the Board’s powers.

The Digi Yatra Angle

• About Digi Yatra: Facial recognition-based paperless boarding at airports, run by the Digi Yatra Foundation. Use is voluntary.
• Concerns raised: Collection of biometric and identity data of passengers, possible sharing, and insistence on Aadhaar for registration.
• Court’s view: The Kerala HC held Digi Yatra cannot insist on Aadhaar alone to verify identity. This is in line with the Aadhaar judgment (Puttaswamy, 2018), which struck down Section 57 of the Aadhaar Act that allowed private entities to demand Aadhaar. The court also expects Voter ID to be accepted as valid proof.
• Why the Board matters here: Without a functional Board, passengers have no specialised forum to complain if their airport data is misused.
• Delay in operationalisation: Although the legal framework and the board were established on paper in late 2025, the Search-cum-Selection Committees have faced delays in making final, active personnel appointments. Without seated members, the board cannot officially form benches or adjudicate disputes. Without a working Board, the Act’s rights and penalties cannot be enforced, as the Kerala High Court has pointed out.

Practice MCQ 

Q1. With reference to the Data Protection Board of India, consider the following statements:

1. It is established under the Digital Personal Data Protection Act, 2023 as a body corporate.
2. Appeals against its orders lie with the concerned High Court.
3. Its Chairperson and Members hold office for a term of five years.

How many of the statements given above are correct?

(a) Only one     (b) Only two     (c) All three     (d) None

Answer: (a)

Explanation: Statement 2 is incorrect, as appeals lie with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Statement 3 is incorrect, as the term is two years with eligibility for reappointment.

Q2. Consider the following statements:

Statement-I: The Digital Personal Data Protection Act, 2023 has amended the Right to Information Act, 2005 with respect to disclosure of personal information.

Statement-II: The Digital Personal Data Protection Act, 2023 allows the Central Government to exempt any instrumentality of the State from its provisions in the interest of the security of the State.

Which one of the following is correct in respect of the above statements?

(a) Both Statement-I and Statement-II are correct and Statement-II explains Statement-I

(b) Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I

(c) Statement-I is correct, but Statement-II is incorrect

(d) Statement-I is incorrect, but Statement-II is correct

Answer: (b)

Explanation: Both statements are correct. The RTI amendment (Section 44(3)) and the power to exempt State agencies (Section 17) are separate provisions; one does not explain the other.