🚀 Science
Data Protection Board has spent nothing weeks before its first big task, RTI shows
In 60 seconds: India's Data Protection Board, the privacy watchdog under the 2023 data law, had spent nothing on salaries, office, rent or computers as of 30 September, an RTI reply shows. It is due to start registering consent managers on 13 November. No chairperson or members have been publicly announced, though the board got a ₹10 crore allocation for 2026-27.
Why it matters
Without a working board, nobody can register consent managers or hear complaints about data leaks, which delays the privacy protections the law promises.
Explain it simply
A new chai market gets rules and a referee's post, but no referee is hired and no chair is bought. When the first dispute comes, who decides?
The 3-minute read
What happened
The IT ministry's reply to an RTI by law student Manya Arora showed zero spending on salaries, office expenses, rent and equipment. Against a ₹5 crore estimate for 2025-26, revised to ₹2 crore, actual spending was about ₹31,000.
Background
The board is to have a chairperson and four members. The ministry invited applications in May and advertised the posts in June, but no appointments have been reported.
How it works
Under the Act, the board can decide personal data breach cases and impose penalties of up to ₹250 crore. Consent managers will help people review and withdraw the consent they give apps and companies.
What's next
Lawyers warn that if the board is not working by 13 November, the next phases of the law could be delayed. Its wider powers are due from 13 May 2027.
What it means for you
Once the system is running, you should be able to see and withdraw the data permissions you have given apps, and complain if your data is misused.
Key numbers
- ₹31,000: Actual spending in 2025-26
- ₹10 crore: Allocation for 2026-27
- ₹250 crore: Maximum penalty the board can impose
- 13 Nov: Date consent manager registration is due to start
Both sides
- Privacy lawyers: An absent board creates a vacuum that can stall the law's next phase.
- The RTI reply's limits: Zero spending does not by itself prove the board was never legally set up.
Key terms explained
- Consent manager
- A registered service that helps people give, review and withdraw consent for use of their data.
- RTI
- Right to Information: a citizen's legal right to ask public bodies for information.
The story so far
- 2017: Supreme Court declares privacy a fundamental right. In Justice K S Puttaswamy vs Union of India (2017), a nine-judge bench held that privacy is a fundamental right under Article 21. This set the stage for a data protection law.
- Aug 2023: Digital Personal Data Protection Act passed. Parliament passed the Digital Personal Data Protection Act, 2023. It sets rules for how companies and government handle personal data and creates the Data Protection Board.
- Nov 2025: DPDP Rules notified; Board provisions take effect. The DPDP Rules, 2025 were notified, and provisions on setting up the Board took effect on 13 November 2025. Consent manager registration starts a year later; the Board's full powers come in May 2027.
- Today: Data board yet to spend; deadline 13 Nov
Exam notes (UPSC, SSC, Banking, PSC)
- The Digital Personal Data Protection Act was passed in 2023.
- The Data Protection Board of India adjudicates personal data breaches under the DPDP Act.
- Privacy was held a fundamental right under Article 21 in the Puttaswamy case (2017).
- The Right to Information Act, 2005 lets citizens seek information from public authorities.
Likely exam question: What are the functions of the Data Protection Board of India under the DPDP Act, 2023?