Section 23 of Digital Personal Data Protection Act, 2023 - Proceedings of Board
Section 23 regulates how the Data Protection Board of India conducts and validates its proceedings. It covers the procedure for Board meetings, authentication of orders and directions, the effect of vacancies or procedural defects, and temporary discharge of the Chairperson's functions.
Text and meaning of Section 23
Section 23(1): The Board shall observe the prescribed procedure for holding meetings and transacting business, including through digital means, and shall authenticate its orders, directions and instruments in the prescribed manner.
Section 23(2): An act or proceeding of the Board is not invalid merely because of a vacancy or defect in the constitution of the Board, a defect in the appointment of a person acting as Chairperson or Member, or a procedural irregularity that does not affect the merits of the case.
Section 23(3): If the Chairperson cannot discharge her functions because of absence, illness or any other cause, the senior-most Member discharges those functions until the Chairperson resumes her duties.
What Section 23 provides
| Provision | Effect |
|---|---|
| Section 23(1) | Requires prescribed procedures for Board meetings, business transactions and authentication of official instruments, including digital proceedings. |
| Section 23(2)(a) | Protects Board proceedings from being invalidated merely because of a vacancy or defect in the Board's constitution. |
| Section 23(2)(b) | Protects proceedings from invalidity merely because of a defect in the appointment of a person acting as Chairperson or Member. |
| Section 23(2)(c) | Distinguishes a non-material procedural irregularity from an irregularity that affects the merits of the case. |
| Section 23(3) | Ensures continuity by assigning the Chairperson's functions to the senior-most Member during temporary inability. |
Rule 18 of the Digital Personal Data Protection Rules, 2025
Rule 18 gives operational effect to Section 23(1). It deals with convening and conducting meetings of the Data Protection Board, decision-making and authentication. Among other matters, it provides for the Chairperson to determine the date, time, place and agenda of meetings, permits delegation of specified meeting-related functions, prescribes quorum and majority-based decision-making, addresses conflicts of interest, and permits specified urgent or circulation-based decision processes.
The Rules also support the statutory design of a digitally functioning Board. The official 2025 Rules and accompanying government material should be consulted together with the Act for the exact procedure applicable to a particular proceeding.
Why Section 23(2) is important
Section 23(2) is a saving provision intended to preserve otherwise valid Board action despite certain institutional or procedural defects. Its protection is not unlimited. In particular, clause (c) expressly refers to a procedural irregularity that does not affect the merits of the case. Whether a particular defect affects the merits will therefore depend on the nature and consequences of that defect in the proceeding concerned.
Data Protection Board of India
The Central Government established the Data Protection Board of India on 13 November 2025, with its head office in the National Capital Region of India. A separate notification provides that the Board consists of four Members.
Related provisions
Section 23 forms part of the statutory framework governing the Data Protection Board. Nearby provisions deal with resignation and vacancies, officers and employees, public-servant status, powers of the Chairperson, powers and functions of the Board, procedure before the Board and appeals.
Last updated: 24 September 2026. This page is a general legal-information summary. For the controlling text, refer to the Act, Rules and notifications published by the Government of India.