After a gap of almost one and a half years since the Digital Personal Data Protection Act, 2023 (hereinafter referred to as “Act”) was published for the general information of the public, the Ministry of Electronics and Information Technology (hereinafter referred to as MeitY), Government of India finally published the Digital Personal Data Protection Rules, 2025 (hereinafter referred to as “draft rules) for wider public consultation and invited comments and suggestion until 18th February 2025.
The Supreme Court of India, in K. S. Puttaswami vs. Union of India[1], upheld privacy as a fundamental right enshrined under Part III of the Constitution of India. In the same judgment, the Supreme Court referred to the constitution of the Committee chaired by Justice B.N. Srikrishna and hoped that the government would follow up on its decision by taking all necessary and proper steps. However, the journey from the Puttaswamy ruling to the current draft Rules has been riddled with hurried enactments and inadequate deliberations. The DPDP Act, 2023 was passed[2] with little debate, leaving critical concerns about its implementation largely unaddressed.
Among the Act’s main features is the establishment of the Data Protection Board of India (hereinafter referred to as DPBI). The law has entrusted the DPBI with the responsibility of protecting and regulating the use of personal data of the data principal and adherence to the provisions of the DPDP Act, 2023. This necessitates the Board’s independence so that it can function smoothly without being controlled.
However, neither the Parent Act nor the draft Rules attempt to reflect the DPBI’s independent, transparent nature. We will dissect how the draft rules have further weakened the already feeble DPBI envisioned through the DPDP Act 2023.
While MeitY claimed that the Government considered the global best practices, including review of the personal data protection legislations of Singapore, Australia, and the European Union and prospective federal legislation of the United States of America, and that the bill would establish the comprehensive legal framework governing digital personal data protection in India. However, the claim does not meet reality when the Act with the draft Rules are compared with EU GDPR, 2016, California Consumer Privacy Act 2018, Personal Data Protection Act, 2012 (revised in 2020) etc.
Section 18 of the Act provides for the establishment of DPBI as a statutory body with perpetual succession and a common seal. A reading of Section 19 of the Act along with Clause 16 of draft rules makes it clear that it is the executives that will be appointing the Chairperson and members of the DPBI, and it is the Government that has the sole discretion to decide that who shall be on the Board. A Search-cum-Selection Committee under proposed clause 16 shall be consisted of the Cabinet Secretary as the Chairperson and the Secretaries to the Government of India in charge of MeitY and the Department of Legal Affairs, and two other experts as the members of the committee. Similarly, under Clause 16(2) the Government shall form another Search-cum-Selection Committee with Secretary of MeitY as Chairperson and Secretary incharge of Dept. of Legal; Affairs and two other expert members of the selection committee.
The 2019 Bill, however, proposed that the selection committee would be composed only of executive members. The JPC, in 2021, recommended the inclusion of the Attorney General and an independent expert in the selection committee. This amendment was proposed to ensure the independence of the authority.
Furthermore, the DPBI under the present framework has been stultified by the expansive powers of the Government. While Section 25 of the Act treats the Board Chairperson and members as public servant within the meaning of Section 21 of Indian Penal Code, 1860 (now repealed), clause 17 and Schedule V, provided that their terms and conditions shall be governed under various Central Civil Services Rules.
The Act, along with the draft rules has given unchecked powers to the Executives to appoint the chairperson and members of the DPBI, thus diluting the independence of the Boards. It is worthy to mention that the Justice Srikrishna Committee, in its report, recommended that in order to ensure independence, the Selection Committee shall also include the Chief Justice of India or her nominee. DPBI-is an institution tasked with ensuring compliance, addressing grievances, and enforcing penalties. However, the effectiveness of this Board hinges on its independence—a feature that has been increasingly questioned due to excessive executive control. Since the State will be the biggest data processor, it is important to have fair and transparent regulatory body free from the clutches of the Government-a necessity that most often the Supreme Court of India has highlighted through its judgments.
In Union of India v. R. Gandhi, the Supreme Court held that tribunals must be constituted in a manner that inspires the confidence of the public in their ability and independence. The Apex Court in Rojer Mathew v. South Indian Bank Ltd. held that there was a compulsory need for the exclusion of control of the executive over quasi-judicial bodies of tribunals discharging responsibilities akin to courts.
Given the fact that under Section 28 (7) of the Act, the DPBI shall have same powers as are vested in a civil court under the Code of Civil Procedure, 1908, it becomes imperative that the Selection Committee for the appointment of the Chairperson and members of the Board must have the representatives of the judiciary, an example that can be taken from the Competition Act, 2002 that provides single selection committee for the appointment of the chairperson and members of the commission comprising of the Chief Justice or his nominee, two members from executives and two independent experts of the respective domains.
Therefore, to restore the DPBI’s independence, it is imperative that the provisions related to the Board be reconsidered and amended. Unrestricted powers could prove dangerous and detrimental to the board’s independent functioning.
[1] (2017) 10 SCC 1
[2] https://pib.gov.in/PressReleaseIframePage.aspx?PRID=2036287
