Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter V — Data Protection Board of India/Section 18 — Establishment of Board
DPDP Act, 2023 · Chapter V · Section 18 of 44

Section 18: Establishment of Board

Section 18 creates the Data Protection Board of India as a legal body corporate — the Act's central regulator and adjudicator, and the section that brought the Board itself into existence on 13 November 2025.

In force since 13 November 2025Reviewed September 2026
Back to the Full DPDP Act GuideNext: Section 19 — Composition and Qualifications for Appointment
StatusIn force
Chapter V · Data Protection Board of India

Quick summary

In plain terms: The Central Government establishes the Data Protection Board of India, with effect from a notified date, as the body responsible for the Act's enforcement. The Board is a body corporate with perpetual succession and a common seal, able to acquire, hold and dispose of property and to sue or be sued in its own name, with its headquarters at a location the Central Government notifies.

What Section 18 says

  • Sub-section (1) — with effect from such date as the Central Government may, by notification, appoint, there shall be established, for the purposes of the Act, a Board to be called the Data Protection Board of India.
  • Sub-section (2) — the Board is a body corporate by the name aforesaid, having perpetual succession and a common seal, with power, subject to the Act's provisions, to acquire, hold and dispose of property, both movable and immovable, and to contract, and shall, by that name, sue or be sued.
  • Sub-section (3) — the Board's headquarters shall be at such place as the Central Government may notify.

Breaking it down

This is a short, purely constitutive section — it doesn't describe what the Board does (that's Sections 27 and 28) or how it's staffed (Sections 19–26); it simply brings the Board into legal existence as an entity.

  • Perpetual succession

    The Board continues to exist whoever the Chairperson or Members are.

  • Common seal & property

    It can contract and acquire, hold and dispose of property.

  • Sue or be sued

    It acts in its own name as an independent legal entity.

“Body corporate” status matters practically, not just formally. Perpetual succession means the Board continues to exist regardless of changes in its Chairperson or Members; a common seal and the power to sue or be sued in its own name mean it operates as an independent legal entity, capable of entering contracts and being a party to litigation, rather than functioning as an unincorporated government department.

This is the section that actually happened first, before anything else in the Board chapter could. Sections 19 through 26 — composition, salaries, disqualifications, procedures, officers, powers of the Chairperson — all presuppose the Board already exists as a legal entity. Section 18's notification is what made everything else in this chapter operable, which is exactly why it was among the first provisions brought into force, alongside the rest of Chapter V, on 13 November 2025.

Why this section matters

Nothing else in the Act's enforcement machinery works without a Board that legally exists. Section 18 is the foundation the rest of Chapter V, and ultimately the Act's entire enforcement and appeal process, is built on.

Real-world example

Example

Why this section came first

When the DPDP Rules were notified alongside the Act's phased commencement, Section 18 (along with the rest of Chapter V) was among the first provisions switched on, on 13 November 2025 — well before the substantive obligations in Chapters II and III became enforceable on 13 May 2027.

  • The reason follows directly from the text — Section 27's enforcement powers, Section 28's inquiry procedures, and the entire appeal process in Chapter VII all assume the Board already exists as a functioning legal entity. Bringing Chapter II's obligations into force before the Board existed to enforce them would have created rights with no working mechanism to vindicate them.

Who needs to care about this section

  • Anyone tracking the DPDP Act's implementation timeline — Section 18 is the legal basis for the Board's existence since 13 November 2025, distinct from when the obligations it enforces actually took effect.
  • Organisations preparing to interact with the Board — as a body corporate, the Board can be sued and can enter contracts in its own name, relevant to understanding its legal status in any dealings.

Common questions

Has the Data Protection Board of India actually been established?
Yes — the Board was established with effect from 13 November 2025, when the Central Government's notification brought Section 18 and the rest of Chapter V into force.
Is the Board a government department or an independent body?
It's a body corporate with perpetual succession, its own common seal, and the power to sue or be sued in its own name — structured as an independent legal entity rather than an ordinary government department.
Where is the Board headquartered?
At whatever location the Central Government notifies under sub-section (3); check current government notifications for the specific address.

Related sections

Section 19 — Composition and Qualifications for Appointment

Continue to the next section in sequence.

Read Section 19

Section 17 — Exemptions

Go back to the previous section.

Read Section 17

Chapter V — Data Protection Board of India

See every section in this chapter together.

View the chapter

Full DPDP Act Guide

Back to the overview page, with the complete section-by-section guide.

View all 44 sections