The Independence Paradox: Reinterpreting the DPDP Act's Data Protection Board

Moulies Anand Raghavan*

The Digital Personal Data Protection Act of 2023, and more recently, its accompanying rules of 2025 have brought India onto the long awaited platform of data compliance and regulation. However, it has not come without its fair share of criticism on multiple grounds, such as its weak application of data protection vis-à-vis third parties and international data sharing, slow implementation, and excessive delegation of powers, among others.

The Act has also sparked considerable concern about the seeming lack of independence of the Data Protection Board of India (“DPBI”), a body constituted under the Act for the purpose of registering Consent Managers, hearing complaints, and determining non-compliance with the Act. In furtherance of this, it is vested with the powers of a civil court and can issue orders, conduct inquiries, and sanction penalties.

This piece proceeds in three steps. It examines this problematic absence of insulation between the board and its constituter, then explains why existing jurisprudence on tribunal independence cannot be extended to the DPBI directly, and finally argues that the true solution lies within the internal contradictions of the Act itself.

Questionable Independence

The Board is constituted wholly by the Central Government. The Act itself was introduced into Parliament by the Minister for Electronics and Information Technology, the same ministry that frames the governing Rules (“MeitY”) , through which it creates the Selection Committee of the Board, and simultaneously, holds a seat on it. The final say as to who is appointed on the board also rests with the Central Government.

However, it doesn’t simply end with appointments, as it is also the authority that can grant leaves to the Chairperson. The tenure of these members is also rather short, spanning two years, a period that is much briefer than the five-year tenure of officers that are appointed by these members. Of course, both the power of reappointment and dismissal is also vested in the Central Government. To top it all off, the acts of the board cannot be called into question on the grounds of improper constitution of the board or appointment of its members.

Such independence is crucial because MeitY is also the principal architect and operator of major data systems such as Aadhaar, DigiLocker, UMANG, API Setu, and the National Informatics Centre, making it the biggest and most likely government respondent in future complaints before the Board. This dynamic leads to a major conflict of interest, wherein MeitY effectively acts as the judge, jury and executioner, or in this case, as a lawmaker, adjudicator, and participant.

The DPBI: A Tribunal?

For this reason, some commentators have argued that the standards laid down in the Madras Bar Association v. Union of India case(s) should be followed with respect to the constitution and functions of the DPBI. Hence, appointment should be effected through a committee with judicial dominance, a five-year tenure with retirement at 67, and removal protected from executive discretion, and so on.

After all, it is ostensibly for all practical purposes an adjudicatory body, and not a regulator by any means, unlike the TRAI. Indeed, the Constitution itself is said to have recognized the doctrine of separation of powers, although it is by no means a rigid distinction, as famously stated in Ram Jawaya Kapur v. State of Punjab (¶14). And this separation is not just a distinction between the judiciary and the executive, but between the judicial power of a tribunal and the executive, granting due independence, as per Union of India v. R. Gandhi (¶35). Why, then, should it not maintain the independence afforded to other tribunals, if it performs the same function? 

This is where the distinction is slight and essential. The DPBI’s lack of regulatory power shouldn’t assume itself the power or title of a tribunal. The mere possession of quasi-judicial power or the powers of a civil court does not automatically translate itself into a tribunal. This distinction between an administrative body with quasi-judicial powers and a tribunal was laid out in the case of Bharat Bank Ltd. v. Employees of Bharat Bank Ltd (¶78), and affirmed later in Jaswant Sugar Mills v. Lakshmi Chand (¶19), where J.C. Shah J., speaking for a five-judge bench stated: “The duty to act judicially imposed upon an authority by statute does not necessarily clothe the authority with judicial power of the State”, and gave examples of Revenue Boards, Customs Authorities, and Income Tax Officers.

For example, the Commissioner of Income Tax or the NHRC are vested with the powers of a civil court. But by no means could one call them a tribunal, as a tribunal’s sole purpose is to hear disputes, whereas these bodies perform other functions too. In a similar manner, the DPBI can also register Consent Managers and has the power to suspend licenses, hire officers and employees, receive audits from Significant Data Fiduciaries, and more. This is the same reason why the TRAI or the CCI were not considered as tribunals for the purposes of the Tribunal Reforms Act, 2021. Hence, the DPBI cannot be considered a tribunal, and thus cannot be emancipated from executive control in the manner laid out in Madras Bar Association.

Unreasonable Results: The Answer Lies Within

However, the above line of thought leads us to an anomalous conclusion. There is a dearth of independence granted to the DPBI, but its appellate body, the TDSAT by contrast, is granted independence. In other words, to have a fair and unbiased result, one would have to appeal the Board’s order (Although commentators have even questioned the TDSAT’s ability too). This effectively nullifies the entire purpose of the DPBI’s adjudicatory function, and places additional burden on its appellate forum.

 It is in this scenario that Section 28(1) of the Act assumes significance. It states, “The Board shall function as an independent body…”. This is to be distinguished from instances where independence is asserted on a member basis, such as “the members of the board are to be persons of integrity”, “they shall ensure absence of a conflict of interest in the performance of their duties” and “can be removed for acquiring financial interest likely to prejudice their functions”. The latter are found in the statute of many regulatory authorities, unlike the former. (For example, see Sections 8(2) and 11(2)(d) of the Competition Act, 2002).

The phrasing “the Board shall function” warrants close attention. Courts have generally interpreted “shall” as mandatory, most notably in U.N.R. Rao v. Indira Gandhi, where the phrase “there shall be a President of India” in Article 52 was held to impose an obligation (¶7). At the same time, the term can be read as merely directory where context or legislative intent suggests otherwise, as held in Jaswantsingh v. Ahmedabad Municipal Corp (¶13). In this case, the continuation of Section 28(2) reads as, “and as far as practicable, function as a digital office”, which gives us the context that the prior phrase, “The Board shall function as an independent body” was indeed mandatory.

Extent of Independence: A two-fold reading 

The next question that naturally arises is the extent of the independence. Can the line of the statute be so read as to mean “The Board shall function as an independent body, except from the government itself”? The answer to this can be explained in a twofold manner.

Firstly, this independence was never assumed to be read in such a manner. On the 2022 draft bill of the DPDP, a Minister of State of IT had clarified that this independence was actually to be read as “independent from the government itself” and that “you will not find people like me or bureaucrats sitting on the board”. However, this alone cannot be taken as conclusive, as this bill was placed with the present revision that members are to be appointed by the Central Government.

Secondly, in Section 28(6) of the Act, the board is bound by the principles of natural justice during inquiry. The following of these principles also extend to quasi-judicial orders, and these authorities are to ensure that the power is exercised fairly and free of arbitrariness, as per CCI v. SAIL (¶86). One of the key principles of natural justice is nemo judex in causa sua, that is, no one should be a judge in their own case. To read into a statute a violation of these principles, in this case, would be reading against the statute itself.

At this point, it will be noted that an apparent conflict between the provisions exists. The Act proclaims independence but simultaneously prescribes that the Central Government, in this case, MeitY, is to lay down rules with respect to appointments. Hence, the two provisions must be reconciled to give effect to both. The Supreme Court in Independent Thought v. Union of India had done the same, reading down the marital rape exception solely against those below 18, hence giving purpose to the Protection of Children from Sexual Offences and Prohibition of Child Marriage Acts.

It is here that I ultimately circle back to the Madras Bar Association case(s), which had repeatedly affirmed that the sponsoring department shall not have any role in the appointment of the Chairperson or Members of the tribunal, however with the reason not because it is a tribunal, rather because it is independent as is. Hence, the term Central Government in Chapter V of the Act, must be read as Ministry of Law and Justice, (as was done in Madras Bar Association 2010, ¶120) to ensure the rules regarding appointment are from any bias.

It is known that rules made by an authority derives its powers from its parent statute and thus cannot exceed its purview. “[They] cannot be made to supplant the provisions of the enabling Act, but to supplement it”  as summed by Pardiwala J. in Kerala State Electricity Board v. Thomas Joseph (¶80). Hence, the existing rules with respect to the board are to be struck down for being ultra vires and curtailing the scope of the parent Act. 

Conclusion

In sum, this piece sought to provide an end-to-end analysis of the DPBI’s independence, and the path that may be required to bring such a statutory requirement into fruition. As India moves towards solidifying its data governance regime, a system that allows for the fair, neutral and effective achievement of such goals is a constitutional and administrative necessity.

*Moulies Anand Raghavan is a second-year law student at National Law University, Delhi.

The views expressed above are the author's alone and do not represent the beliefs of Pith & Substance: The CCAL Blog.