Chapter V · Data Protection Board of India
Section 18: Establishment of the Board
Section 18 establishes the Data Protection Board of India, the independent body corporate that enforces the DPDP Act, with its seat wherever the Central Government notifies.
- Chapter
- Chapter V · Data Protection Board of India
- Status
- In force
- In force since
- 13 November 2025
- Applies to
- Data Protection Board
- Official citation
- DPDP Act, 2023, s.18
- Reading time
- 3 min
- Updated
- August 2026
At a glance
Section 18 establishes the Data Protection Board of India as the body that enforces the DPDP Act [18(1)]. The Board is a body corporate with perpetual succession and a common seal, able to own and dispose of property, enter contracts, and sue or be sued [18(2)], with its headquarters at a place the Central Government notifies [18(3)]. It is the authority that inquires into breaches, directs remedial measures and imposes penalties. This section came into force on 13 November 2025.
Key takeaways
- Section 18 creates the Data Protection Board of India, the Act's enforcement authority [18(1)].
- The Board is a body corporate: it can own property, contract, and sue or be sued in its own name [18(2)].
- Its headquarters sit wherever the Central Government notifies [18(3)].
- This is one of the provisions already in force, since 13 November 2025, ahead of the main obligations.
Who should read this
Read this if you want to understand the regulator: the Board established here is the body that receives complaints, inquires into breaches and imposes penalties under the Act.
In plain language
Section 18 sets up the regulator. The Data Protection Board of India is the body that will actually enforce the Act: receive complaints, inquire into breaches and impose penalties.
It is created as a body corporate, a legal person in its own right, so it can hold property, sign contracts and be a party in court. Its location is left to a government notification.
The text of the law
Section 18: Establishment of the Board
18(1) A Data Protection Board of India is established with effect from a date the Central Government notifies.
18(2) The Board is a body corporate with perpetual succession and a common seal, able to acquire, hold and dispose of property, to contract, and to sue and be sued.
18(3) The headquarters of the Board is at the place the Central Government notifies.
Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.
What this means for you
- For a company, this is the body you answer to on data protection: the Board decides complaints and imposes penalties under the Act.
- Nothing to implement, but note the Board is already legally established, so build your grievance and breach-response processes to deal with a real regulator, not a future one.
Frequently asked questions
What is the Data Protection Board of India?
Is the Board a government department?
Where is the Board located?
Is Section 18 in force?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.