The Board must follow prescribed procedures for meetings and business, including digital meetings, and authenticate its orders, directions and instruments as prescribed. Proceedings remain valid despite vacancies, constitutional or appointment defects, and non-merits procedural irregularities. If the Chairperson is unable to act owing to absence, illness or another cause, the senior-most Member performs the Chairperson's functions until duties resume.

Resignation by the Chairperson or any other Member becomes effective upon the earliest specified event, including permission to relinquish office, lapse of three months, appointment of a successor, or expiry of term. Vacancies must be filled by fresh appointment. Former office-holders are subject to a one-year post-tenure employment restriction, requiring prior approval and disclosure of employment with Data Fiduciaries involved in proceedings initiated by or before them.

Section 21 disqualifies persons from appointment or continuation as Chairperson or Member where they are insolvent, convicted of an offence involving moral turpitude, physically or mentally incapable, or hold interests likely to prejudice official functions. Abuse of office prejudicial to the public interest is also a disqualification. Removal by the Central Government requires that the concerned Chairperson or Member be given an opportunity to be heard.

Service conditions of the Chairperson and other Members of the Data Protection Board of India are to be prescribed, and their salary, allowances and other terms cannot be varied to their disadvantage after appointment. They hold office for a two-year term and are eligible for re-appointment.

The Data Protection Board of India comprises a Chairperson and a notified number of Members, appointed by the Central Government in the prescribed manner. Appointees must demonstrate ability, integrity and standing, with special knowledge or practical experience in governance, legal, technological, economic, regulatory, consumer-protection or dispute-resolution fields, or another field considered useful to the Board. At least one appointee must be a law expert.

Section 18 establishes the Data Protection Board of India with effect from 13 November 2025, following appointment by the Central Government. The Board is a body corporate with perpetual succession and a common seal. Subject to the Act, it may acquire, hold and dispose of movable and immovable property, enter into contracts, and sue or be sued in its corporate name. Its headquarters must be located at a place notified by the Central Government.

Section 17 disapplies Chapter II requirements, except section 8(1) and (5), Chapter III, and section 16 for defined processing, including legal claims, judicial or regulatory functions, law enforcement, foreign-data contracts, approved corporate restructuring, and assessment of loan defaulters' financial information. It allows broader exclusions for notified State processing on specified public-interest grounds and for research, archiving, or statistical purposes where no decision is made about a Data Principal and prescribed standards are followed.

Cross-border processing of personal data may be restricted through notification for transfers by a Data Fiduciary to specified countries or territories outside India. The provision preserves the operation of Indian laws imposing higher protection standards or stricter restrictions on transfers of personal data outside India, whether concerning particular personal data, Data Fiduciaries, or classes thereof.

Section 15 requires Data Principals to exercise personal-data rights in compliance with applicable laws. They must not impersonate another person, suppress material information when furnishing personal data for State-issued identity or address documentation, or lodge false or frivolous grievances or complaints. Information furnished while exercising correction or erasure rights must be verifiably authentic.

Right to nominate enables a Data Principal to designate another individual, in the manner prescribed by law, to exercise the Data Principal's rights upon death or incapacity. The nominee acts in accordance with the applicable statutory framework and governing rules. Incapacity means inability to exercise Data Principal rights because of unsoundness of mind or infirmity of body.

Section 13 grants a Data Principal the right to readily available grievance redressal against acts or omissions of a Data Fiduciary or Consent Manager concerning personal-data obligations or the exercise of rights. Data Fiduciaries and Consent Managers must respond within the prescribed period. The Data Principal must exhaust the available grievance-redressal process before approaching the Board.

Data Principals may seek correction, completion, updating and erasure of personal data processed on the basis of prior consent, subject to applicable legal requirements and procedures. Data Fiduciaries must correct inaccurate or misleading data, complete incomplete data, and update personal data upon request. Erasure must be carried out unless retention is necessary for the specified purpose or compliance with applicable law.

A Data Principal may, through a prescribed request, obtain from a consenting Data Fiduciary a summary of personal data processed, related processing activities, and further prescribed information. The Data Principal may also obtain identities of recipients with whom data was shared and a description of the shared data. Recipient-disclosure obligations are excluded for legally authorised sharing pursuant to written requests concerning prevention, detection or investigation of offences or cyber incidents, or prosecution or punishment of offences.

Significant Data Fiduciary status may be notified after considering the scale and sensitivity of personal data processing and related risks to Data Principal rights, national interests, electoral democracy, State security, and public order. Such fiduciaries must appoint an India-based Data Protection Officer and an independent data auditor, conduct periodic Data Protection Impact Assessments and audits, and comply with further prescribed measures.

Data Fiduciaries must obtain verifiable consent from a child's parent or lawful guardian before processing a child's personal data and must not undertake processing likely to harm the child's well-being. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited. Prescribed exemptions may apply to specified Data Fiduciaries, purposes and conditions. Where processing is verifiably safe, an age-based exemption may apply to specified consent and child-protection obligations.

Data Fiduciaries remain responsible for compliant personal-data processing undertaken by them or by Data Processors, who may be engaged only under valid contracts. They must maintain data quality for consequential decisions or disclosures, implement technical and organisational compliance measures, maintain reasonable security safeguards, and notify the Board and affected Data Principals of breaches. Personal data must be erased on consent withdrawal or when its purpose ends, unless legal retention is required, including erasure by Data Processors. They must also publish appropriate contact information and provide effective grievance redressal.

A Data Fiduciary may process personal data for the specified purpose for which a Data Principal voluntarily supplies it, provided the Data Principal has not indicated non-consent, and must cease processing when requested assistance is no longer required. Processing is also permitted for prescribed State benefits and functions, legally required disclosures, compliance with judgments or orders, medical emergencies, public-health threats, disasters, public-order breakdowns, and employment purposes. Employment-related processing includes protection against loss or liability, prevention of corporate espionage, confidentiality of trade secrets, intellectual property or classified information, and provision of employee-requested services or benefits.

Consent for personal-data processing must be free, specific, informed, unconditional and unambiguous, based on clear affirmative action, and limited to data necessary for the stated purpose. Consent requests must be clear, accessible in prescribed languages, and provide relevant contact details. Data Principals may withdraw consent as easily as it was given; the Data Fiduciary and its Data Processors must then cease processing within a reasonable time unless processing is legally required or authorised. Where consent is disputed, the Data Fiduciary must prove compliant notice and consent.

A Data Fiduciary seeking consent must give or precede its request with notice identifying the personal data proposed for processing, the processing purpose, the Data Principal's rights, and the complaint mechanism before the Board. For consent obtained before commencement, equivalent information must be provided as soon as reasonably practicable, while processing may continue until consent is withdrawn. Notices must be accessible in English or an Eighth Schedule language.

Processing of a Data Principal's personal data is permitted only in accordance with the Act, for a lawful purpose, and on the basis of consent or certain legitimate uses. A lawful purpose is one not expressly forbidden by law. These alternative grounds govern the basis for processing within Data Fiduciary obligations. Section 4 is to come into force eighteen months after 13 November 2025.