The Data Protection Board of India Has No Members Yet: What Indian SMEs Should Do Before May 2027

If you run a startup or a mid-sized company in India, you may have heard a comforting line lately: "The Data Protection Board of India doesn't even exist yet, so what's the rush?" It is half true, and the half that is false can cost you real money. The Data Protection Board of India was created on paper on 13 November 2025, but as of the latest reporting we could find (August 2026) it still had no Chairperson and no Members. Here is what that gap means, and why it is a poor reason to pause your DPDP Act compliance work.

Where the Data Protection Board of India stands today

The DPDP Rules, 2025 were notified as G.S.R. 846(E) on 13 November 2025. The same day, the provisions that set up the Board (Sections 18 to 26 of the Act) and Rules 17 to 21, which cover its constitution, procedure and terms of service, came into force.

Setting up the people is a separate matter. The Chairperson is picked by a search-cum-selection committee headed by the Cabinet Secretary, with the Secretaries of Legal Affairs and MeitY and two outside experts. A second committee, chaired by the MeitY Secretary, picks the Members. Section 19(3) requires at least one Member with legal expertise.

On 6 May 2026 the government wrote to Union ministries and State and UT Chief Secretaries asking for nominations. A recruitment notice in June sought one Chairperson and four Members, and a Lok Sabha written answer on 12 August 2026 confirmed the advertisement. Legal commentary published in August, including a LiveLaw analysis dated 1 August and a tracker at India Data Law, reports that no appointments had been made. We could not find a gazette notification or official release naming anyone, so treat any website that lists a sitting Chairperson with caution. Check MeitY's notifications before you rely on the status in this article.

What a Board with no members cannot do

Without Members, the Board cannot convene, hear a complaint or pass an order. In practice that means three things for you today.

First, there is nowhere for a customer or employee to file a DPDP complaint against your company. Second, the penalty machinery is dormant. Sections 27 and 28 (inquiry and procedure) and Sections 33 and 34 (penalties and adjudication) are due to take effect with the main obligations on 13 May 2027. Third, even breach reports under Section 8(6), which go to the Board, have no live recipient yet.

The courts have already run into this. In Parth Sharma v. Union of India, the Madhya Pradesh High Court (Indore Bench) sent a petitioner challenging Instagram's plan to drop end-to-end encrypted messaging to the Board, asking for a reasoned order within fifteen days, even though no one was sitting on it. Commentators have pointed out that the direction assumed a working Board. It is a reminder that "no Board" does not mean "no consequences". It means the first enforcement round has not started.

Why waiting is a bad bet for Indian SMEs

The date that matters is 13 May 2027, when notice, consent, data principal rights, breach notification and Significant Data Fiduciary duties become enforceable. The Board does not need to exist today for it to exist by then. If the appointments land in early 2027, the Board will have its first live inquiries on day one.

Penalties are steep and tiered. Up to ₹250 crore applies to failing to maintain reasonable security safeguards. Up to ₹200 crore applies to failing to notify the Board and affected individuals of a breach, or to breaching the rules on children's data. Up to ₹50 crore covers other violations. These are maximums per instance, and a small company is unlikely to see the top figure, but the ceiling shapes how investors, enterprise buyers and insurers ask questions today.

There is also the November milestone. Rule 4, covering Consent Manager registration with the Board, comes into force one year after publication, so on or about 13 November 2026. Some sources count it as 14 November. Either way it is weeks away, and the Board has to be able to register those entities. If it still has no Members, expect a delay or a workaround, and watch MeitY for clarification.

Finally, the older rules still apply: the IT Act, CERT-In's six-hour incident reporting directions and sectoral regulators such as RBI, SEBI and IRDAI.

A practical plan for the months before May 2027

Treat the gap as a build window rather than a holiday. A sensible order of work looks like this.

1. Map your data. List what personal data you collect, why, where it sits, and which vendors touch it. Without this map every other step is guesswork. Our DPDP compliance checklist is a quick starting point.
2. Fix notice and consent. Rewrite privacy notices in plain language and check that consent is specific and withdrawable as easily as it was given. More detail on the obligations sits on our DPDP Act compliance page.
3. Build the rights workflow. Rule 14 expects you to publish, prominently on your website or app, how a person can make a rights request and what identifier (for example an email address or customer ID) they should use. You must also publish your grievance process and respond within a reasonable period of no more than ninety days, with systems in place to hit that deadline. Decide who owns the inbox, who verifies identity, and how long you keep the request log.
4. Prepare a breach playbook. The expectation is prompt intimation to the Board and affected individuals, followed by a detailed report to the Board within 72 hours. Write down who decides, who calls, and what gets logged, then rehearse it once.
5. Review your vendors. Most SME breaches start with a processor. Check contracts for security obligations, breach notice timing and deletion on exit.
6. Decide who is accountable. Not every company must appoint a Data Protection Officer, but someone has to own this. If you may be designated a Significant Data Fiduciary, read about data protection officer services and consider a privacy impact assessment for your riskiest processing.

If you also serve EU customers, GDPR still has working regulators and recent fines, so your GDPR compliance work cannot wait on India's Board.

What to watch next

Look for a MeitY notification naming the Chairperson and Members, and any clarification on the November Consent Manager date. We found no instrument shortening the 18-month period. For a second pair of eyes on your readiness, our services team can run a gap assessment.

This article is general guidance and not legal advice. Facts were checked against publicly reported sources as of October 2026; confirm current status with the official Gazette. Want to see where you stand? Start with our free DPDP checklist or talk to us.