Section 18 of Digital Personal Data Protection Act, 2023 - Establishment of Data Protection Board of India
Updated: 24 September 2026
Section 18 of the Digital Personal Data Protection Act, 2023 provides the statutory basis for establishing the Data Protection Board of India. It defines the Board as a body corporate and authorises the Central Government to notify the place of its headquarters.
Section 18 - Establishment of Board
(1) With effect from such date as the Central Government may, by notification, appoint, there shall be established, for the purposes of this Act, a Board to be called the Data Protection Board of India.
(2) The Board shall be a body corporate by the name aforesaid, having perpetual succession and a common seal, with power, subject to the provisions of this Act, to acquire, hold and dispose of property, both movable and immovable, and to contract and shall, by the said name, sue or be sued.
(3) The headquarters of the Board shall be at such place as the Central Government may notify.
Meaning and legal effect of Section 18
Section 18 creates the legal framework for the Data Protection Board of India. Sub-section (1) authorises the Central Government to establish the Board by notification. The Board was formally established with effect from 13 November 2025 by notification G.S.R. 844(E).
Under sub-section (2), the Board has a separate corporate legal identity. The expression body corporate means that the Board can continue irrespective of changes in its membership, hold and dispose of movable or immovable property, enter into contracts, and sue or be sued in its own name, subject to the Act.
Sub-section (3) empowers the Central Government to notify the location of the Board's headquarters. G.S.R. 844(E) specifies that the head office of the Data Protection Board of India shall be in the National Capital Region of India.
Commencement and establishment of the Board
The Central Government issued G.S.R. 843(E) on 13 November 2025 bringing, among other provisions, Sections 18 to 26 of the Digital Personal Data Protection Act, 2023 into force from the date of publication of that notification in the Official Gazette.
By G.S.R. 844(E), also dated 13 November 2025, the Central Government exercised the powers under Section 18(1) and Section 18(3) and established the Data Protection Board of India. This notification also fixed the Board's head office in the National Capital Region.
Further, G.S.R. 845(E), issued under Section 19(1), provides that the Data Protection Board of India shall consist of four members. In May 2026, the Ministry of Electronics and Information Technology invited applications for one post of Chairperson and four posts described as Members for preparation of a panel for consideration by the Search-cum-Selection Committee.
Why Section 18 is important
- It provides the statutory authority for creation of the Data Protection Board of India.
- It gives the Board a distinct corporate identity with perpetual succession and a common seal.
- It enables the Board to own and dispose of property, contract, and sue or be sued in its own name.
- It permits the Central Government to determine the headquarters of the Board by notification.
- It forms part of Chapter V of the Act, which deals with the Data Protection Board of India.
Related provisions
Section 18 should be read with Section 19, dealing with composition and qualifications for appointment of the Chairperson and Members, and Section 20, dealing with salary, allowances and term of office. For the broader statutory framework, see the Digital Personal Data Protection Act, 2023.
Official legal resources
For authoritative text and updates, refer to the Ministry of Electronics and Information Technology resources for the Digital Personal Data Protection Act, 2023, the commencement notification, the notification establishing the Data Protection Board of India, and the Digital Personal Data Protection Rules, 2025.