Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this section

Chapter V · Data Protection Board of India

Section 18: Establishment of the Board

Section 18 establishes the Data Protection Board of India, the independent body corporate that enforces the DPDP Act, with its seat wherever the Central Government notifies.

Official text
Section 18Establishment of the Board
Chapter
Chapter V · Data Protection Board of India
Status
In force
In force since
13 November 2025
Applies to
Data Protection Board
Official citation
DPDP Act, 2023, s.18
Reading time
3 min
Updated
August 2026

At a glance

Section 18 establishes the Data Protection Board of India as the body that enforces the DPDP Act [18(1)]. The Board is a body corporate with perpetual succession and a common seal, able to own and dispose of property, enter contracts, and sue or be sued [18(2)], with its headquarters at a place the Central Government notifies [18(3)]. It is the authority that inquires into breaches, directs remedial measures and imposes penalties. This section came into force on 13 November 2025.

Applies to The BoardChapter Chapter VEffective 13 Nov 2025Read time 3 min

Section 18: key takeaways

  • Section 18 creates the Data Protection Board of India, the Act's enforcement authority [18(1)].
  • The Board is a body corporate: it can own property, contract, and sue or be sued in its own name [18(2)].
  • Its headquarters sit wherever the Central Government notifies [18(3)].
  • This is one of the provisions already in force, since 13 November 2025, ahead of the main obligations.

Who Section 18 applies to

Read this if you want to understand the regulator: the Board established here is the body that receives complaints, inquires into breaches and imposes penalties under the Act.

FoundersLegal / DPOCompliance leadsProduct / engineering

Section 18 in plain language

Section 18 sets up the regulator. The Data Protection Board of India is the body that will actually enforce the Act: receive complaints, inquire into breaches and impose penalties.

It is created as a body corporate, a legal person in its own right, so it can hold property, sign contracts and be a party in court. Its location is left to a government notification.

Section 18 of the DPDP Act: full text

Section 18: Establishment of the Board

18(1) A Data Protection Board of India is established with effect from a date the Central Government notifies.

18(2) The Board is a body corporate with perpetual succession and a common seal, able to acquire, hold and dispose of property, to contract, and to sue and be sued.

18(3) The headquarters of the Board is at the place the Central Government notifies.

Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.

What Section 18 means for your business

  • For a company, this is the body you answer to on data protection: the Board decides complaints and imposes penalties under the Act.
  • Nothing to implement, but note the Board is already legally established, so build your grievance and breach-response processes to deal with a real regulator, not a future one.

Frequently asked questions about Section 18

What is the Data Protection Board of India?
It is the statutory body established under Section 18 to enforce the DPDP Act, inquire into breaches and impose penalties.
Is the Board a government department?
No. It is a body corporate, a separate legal person that can hold property, contract and sue or be sued, though its members are appointed by the Central Government.
Where is the Board located?
At the headquarters the Central Government notifies.
Is Section 18 in force?
Yes. It came into force on 13 November 2025, ahead of the main compliance obligations.

Sources

Related sections
Section 19: Composition of the BoardSection 26: Powers of the ChairpersonData Protection Board (glossary)Chapter V overview

This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.

Start readiness assessment