Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter V — Data Protection Board of India/Section 19 — Composition and Qualifications for Appointment
DPDP Act, 2023 · Chapter V · Section 19 of 44

Section 19: Composition and Qualifications for Appointment

Section 19 sets out who sits on the Board and what qualifies them — a Chairperson and Members appointed by the Central Government, chosen for ability, integrity and relevant expertise, with at least one required to be a legal expert.

In force since 13 November 2025Reviewed September 2026
Back to the Full DPDP Act GuideNext: Section 20 — Salary, Allowances and Term of Office
StatusIn force
Chapter V · Data Protection Board of India

Quick summary

In plain terms: The Board consists of a Chairperson and however many other Members the Central Government notifies. The Central Government appoints them in the prescribed manner. Each must be a person of ability, integrity and standing, with special knowledge or practical experience in a relevant field — data governance, dispute resolution, ICT, digital economy, law, regulation or techno-regulation, among others — and at least one Member must be an expert in the field of law.

What Section 19 says

  • Sub-section (1) — the Board consists of a Chairperson and such number of other Members as the Central Government may notify.
  • Sub-section (2) — the Chairperson and other Members shall be appointed by the Central Government in the prescribed manner.
  • Sub-section (3) — the Chairperson and other Members shall be persons of ability, integrity and standing who possess special knowledge or practical experience in fields including data governance, administration or implementation of laws related to social or consumer protection, dispute resolution, information and communication technology, digital economy, law, regulation or techno-regulation, or any other field the Central Government considers useful to the Board, and at least one among them shall be an expert in the field of law.

Breaking it down

This section covers two things: how many people sit on the Board and how they're chosen (sub-sections 1 and 2), and what qualifies someone to be chosen (sub-section 3).

Board size isn't fixed by the Act itself. Sub-section (1) leaves the number of Members to the Central Government's own notification, giving flexibility to scale the Board's composition over time rather than locking in a specific number in the statute.

The qualification list is broad by design, spanning technical, legal and administrative expertise. Rather than requiring every Member to be a lawyer or a technologist specifically, sub-section (3) recognises that effective data-protection regulation draws on a mix of disciplines — consumer protection administration, dispute resolution, ICT, digital economy expertise, and regulation or techno-regulation specifically. The one fixed requirement is that at least one Member be a legal expert, ensuring the Board always has that expertise represented regardless of its other members' backgrounds.

“Ability, integrity and standing” is a qualitative threshold the Rules and appointment process will operationalise. The Act states the standard but leaves the actual appointment procedure — how candidates are identified, evaluated, and selected — to be prescribed.

Why this section matters

The credibility of a regulator depends heavily on who sits on it. Section 19 is what ensures the Board isn't staffed arbitrarily — it requires a deliberate mix of expertise suited to the range of issues the Board will actually handle, from technical security questions to legal disputes to consumer-protection concerns.

Real-world example

Example

What a qualifying Board Member profile might look like

Section 19(3)'s language suggests the kind of backgrounds the Board is designed to draw on — not a single template, but a mix:

  • A former regulator or administrator — with experience in consumer-protection law implementation.
  • A technologist or information-security expert — with practical ICT and digital-economy experience.
  • A dispute-resolution specialist — such as someone with mediation or tribunal experience.
  • At minimum, one legal expert — one Member who is specifically an expert in the field of law, as sub-section (3) requires.

Who needs to care about this section

  • Organisations and individuals appearing before the Board — understanding the range of expertise Members are meant to bring can be useful context for how proceedings are likely to be approached.
  • Anyone tracking Board appointments — sub-section (2)'s prescribed appointment process and sub-section (1)'s flexible Member count mean the Board's composition can evolve over time via notification.

Common questions

How many Members does the Board have?
The Act doesn't fix a specific number — sub-section (1) leaves that to the Central Government's own notification.
Does every Board Member need to be a lawyer?
No — sub-section (3) requires only that at least one Member be an expert in the field of law; other Members can come from a range of backgrounds including data governance, ICT, dispute resolution, and consumer protection administration.
Who decides how Board Members are actually selected?
The appointment is made by the Central Government, in a manner prescribed by the DPDP Rules; the Act itself sets the qualification standard but leaves the selection process's mechanics to be prescribed.

Related sections

Section 20 — Salary, Allowances and Term of Office

Continue to the next section in sequence.

Read Section 20

Section 18 — Establishment of Board

Go back to the previous section.

Read Section 18

Chapter V — Data Protection Board of India

See every section in this chapter together.

View the chapter

Full DPDP Act Guide

Back to the overview page, with the complete section-by-section guide.

View all 44 sections