India's Ministry of Electronics and Information Technology used a single sentence in the Gazette of India on November 13, 2025 to settle the size of the country's new privacy regulator: the Data Protection Board of India "shall consist of four members." Twelve months on, none of those seats has been filled, according to the legal trackers that follow the Board, even as the first provisions that route companies to it take effect on November 13, 2026.

In Short

India decided in November 2025 that its new privacy regulator would have four members, and a year later nobody has been appointed to it. From November 13, 2026, companies that want to act as consent managers, the services that let people give and withdraw permission for their data across many apps, have to register with that regulator. Until the seats are filled, the registration rule exists on paper but there is no one to approve an application, and the bigger set of privacy obligations arrives on May 13, 2027 with the same gap. A Kerala court has said it expects the Board to be working within eight weeks of its October 7, 2026 hearing.

A notification of one sentence

The notification, numbered G.S.R. 845(E), appeared as issue No. 759 of the Gazette of India Extraordinary, Part II, Section 3, Sub-section (i), dated Thursday, November 13, 2025 (Kartika 22, 1947 in the Saka calendar). It is two pages long. The first page carries the Hindi text; the second repeats it in English. There is one operative sentence.

According to the English text, the Central Government acted "in exercise of the powers conferred by sub-section (1) of section 19 of the Digital Personal Data Protection Act, 2023 (22 of 2023)" and "hereby notifies that the Data Protection Board of India shall consist of four members." The order carries file number AA-11038/1/2025-CL&ES and is signed by Ajit Kumar, Joint Secretary.

The document also explains a date discrepancy that has followed India's data protection rules since they were published. The issue is dated November 13, but its electronic reference number, CG-DL-E-14112025-267649, embeds 14 November 2025, and the digital signature applied for the Government of India Press at Mayapuri, New Delhi, is stamped 10:40:26 IST on November 14, 2025. That one-day gap between the printed date and the upload is why some legal summaries date the regime to November 14 while the notifications themselves say November 13.

G.S.R. 845(E) was part of a set. Companion notifications the same day brought parts of the Act into force (G.S.R. 843(E)) and formally established the Board, with its head office in the National Capital Region (G.S.R. 844(E)). The Digital Personal Data Protection Rules, 2025 were issued in the same cycle. PPC Land reported on those rules on November 15, 2025, including the consent manager framework, the 72-hour deadline for reporting breaches to the Board, and the salary levels set for its members.

Four members, five posts

The sentence leaves a question the text alone does not answer. Section 19(1) of the Act provides that the Board consists of a Chairperson plus a number of other Members that the government notifies. Read against that provision, "four members" fixes the number of Members, not the total headcount.

The ministry's own recruitment followed that reading. A circular from MeitY's Personnel-I section, F. No. 2(1)/2026-Pers.I, dated May 6, 2026, invited applications for one Chairperson post and four Member posts, five in all, according to the circular. It describes the Board as a body corporate set up under Section 18 of the Act and as an institution designed to be digital from the outset, with filings and hearings handled online.

The eligibility terms are specific. Applicants had to be at least 55 years old on the closing date for applications. Appointments run for a term of up to two years or until the appointee turns 65, whichever comes first. The Chairperson must have held a post equivalent to Additional Secretary or above in government, and Members a post equivalent to Joint Secretary or above, with at least five years of experience in a relevant field. At least one Member must be a legal expert, according to the circular. Pay is a consolidated 450,000 rupees a month for the Chairperson and 400,000 rupees for each Member, without official housing or a car, matching the figures in the 2025 rules. Travel and leave entitlements follow Level 17 of the government pay matrix for the Chairperson and Level 15 for Members.

Candidates are shortlisted by a search-cum-selection committee. Published accounts of its structure differ. LiveLaw, in an August 1, 2026 opinion article by Raghvendra Kumar Chaudhary, an assistant professor at CHRIST (Deemed to be University), described two committees: one chaired by the Cabinet Secretary to select the Chairperson, and one chaired by the MeitY Secretary to select Members. DPDP Guard, a compliance software vendor, described a single committee chaired by the Cabinet Secretary for both roles.

A year of recruiting and no appointments

The May 6 circular was the first public step toward filling the seats. It came almost six months after the Board was established on paper. A recruitment advertisement for a Chairperson and four Members followed in Employment News on June 6, 2026, according to India Data Law, a reference site that checks the Board's status monthly. A written answer in the Lok Sabha on August 12, 2026 confirmed the advertisement, according to the same site.

No appointment has been announced since. LiveLaw's August 1 opinion piece said the Board had neither a Chairperson nor Members eight months after the rules were notified. Sansa Legal, a Bengaluru law firm, described the Board on August 12 as being in a pre-operational state. MirvoLegal, a New Delhi firm, said in a review dated September 20 that no Chairperson or Members had been reported as appointed. Data Adhikaar, a compliance publisher, said in mid-October that trackers watching official channels had seen no appointment notification. DPDP Guard wrote that as of November 1, 2026, no Chairperson or Member had been appointed.

DPDP Guard's statement came with a correction. A post it first published on June 30 had claimed the Board had leadership in place from June 6; the vendor later rewrote it to say that claim was wrong. Privacy Labs, another compliance publisher, noted in October that some websites had reported June appointments and that it could find no Gazette notification or MeitY press release to support them. How did a claim like that survive for months? Partly because the official record is so thin: the Board's public footprint consists of four notifications, one circular and one advertisement.

The only recent signal of movement came from Whalesbook, which reported on October 30, 2026 that MeitY was moving to finalise appointments of Board members. The report named no candidates and cited no sources beyond a court direction.

Courts are already routing work to an empty Board

Courts have not waited for the appointments. In April 2026, a Division Bench of the Madhya Pradesh High Court at Indore, made up of Justice Vijay Kumar Shukla and Justice Alok Awasthi, directed the petitioner in Parth Sharma v. Union of India to make a representation to the Board within seven days, and the Board to decide it within fifteen days by a reasoned order after a hearing, according to the LiveLaw opinion article. The article argued that the Board, lacking members, could not convene a bench to comply.

The Kerala High Court took a more direct line. In C.R. Neelakandan v. Union of India, WP(PIL) No. 15 of 2026, a public interest petition about passenger data collected through Digi Yatra, the face-recognition boarding system at Indian airports backed by the Ministry of Civil Aviation, the court had asked the central government in March 2026 whether the Board had been constituted at all, according to Bar and Bench. The petitioner sought directions to the civil aviation ministry, the Airports Authority of India and MeitY to make passenger data handling comply with the Act and the 2025 rules.

At the hearing on October 7, 2026, the central government's counsel told the bench of Chief Justice Soumen Sen and Justice Syam Kumar V.M. that the Board had been constituted but not yet made functional, according to LiveLaw's October 10 report. The court said the issue could not be ignored because citizens' privacy was being compromised, and recorded that it expected the Board to be made functional within eight weeks. Counted from October 7, eight weeks ends on December 2, 2026, by PPC Land's calculation. The bench disposed of the petition, according to India Data Law, so no further hearing is scheduled to check on that expectation.

What changes on November 13, 2026

The commencement notification issued alongside G.S.R. 845(E) split the Act into three tranches. The first, on publication, brought in the definitions and Sections 18 to 26, which create the Board and govern its members, along with several general provisions. That is why the Board has existed in law since November 13, 2025.

The second tranche starts one year after publication, on November 13, 2026. It covers just two provisions: Section 6(9), which requires every consent manager to register with the Board, and Section 27(1)(d), which gives the Board power to inquire into a consent manager's breach of its registration conditions. Rule 4 of the 2025 rules, which sets out how registration works, takes effect the same day.

Consent managers are the Act's mechanism for letting an individual give, review and withdraw consent across many companies through one interface. Under the rules, an applicant must be a company incorporated in India with a net worth of at least 2 crore rupees (20 million rupees), its platform must be independently certified, and its directors and senior managers may not hold positions or financial interests in the companies whose consent requests it handles. A consent manager differs from a consent management platform of the kind European publishers deploy under the GDPR: a CMP works for the website or app that installs it, while an Indian consent manager is accountable to the individual and registered with the regulator.

Rule 4 directs applications to the Board. With no Chairperson or Member in post, nobody holds the authority to approve one. Privacy Labs described the provision in October as being in force on paper with no one to decide an application. ComplianceHub, writing in August, said the registration process was not operating. None of the trackers reported a single application or registration.

The compliance market also disagrees about who else is affected on that date. Sansa Legal wrote in August that the framework would require data fiduciaries to integrate with registered consent managers. Privacy Labs said that for companies not applying to become consent managers, nothing new is legally required on November 13. The commencement notification supports the narrower reading: the rest of Section 6, including the provision that lets an individual act through a consent manager, sits in the third tranche.

The 18-month date and a compression that never came

That third tranche starts eighteen months after publication, on May 13, 2027. It carries almost everything that bears on day-to-day data handling: notice and consent, security safeguards, breach notification, the rights of individuals, the rules on children's data, the extra duties of significant data fiduciaries, and the Board's inquiry and penalty powers under Sections 27, 28, 33 and 34. The Act's Schedule caps the penalty for failing to take reasonable security safeguards at 250 crore rupees.

The government had said it wanted that window shorter. Business Standard reported that IT minister Ashwini Vaishnaw said in November 2025 that the government was in talks with industry about compressing the timeline from 18 months to 12. On January 22, 2026, the newspaper reported, citing unnamed sources, that MeitY had proposed at a stakeholder meeting to bring forward certain provisions for significant data fiduciaries to 12 months, which would have put them on November 13, 2026. The ministry did not respond to the newspaper. A feedback deadline of February 4, 2026 was reported by the law firm S.S. Rana & Co., according to dpdprules.org.

No amendment followed. As of late October 2026, no instrument changing the commencement periods had been located, according to dpdprules.org and MirvoLegal. The date the government once wanted to pull forward to now falls on the same day as a registration duty that the Board cannot administer.

Why an empty regulator matters for advertising

India's advertising market has been reshaped since mid-2025 by platform rules and sector regulators rather than by its privacy law. Meta required SEBI verification for securities and investment ads targeting India, with enforcement from July 31, 2025. Google barred rummy and daily fantasy sports ads targeting India from January 21, 2026. OpenAI switched on ChatGPT ads in India on August 29, 2026, part of a run of 32 new markets in five days. None of those changes depended on the Data Protection Board.

That changes in May 2027. Advertisers, publishers and ad tech companies that decide why and how personal data of people in India is processed will be data fiduciaries, the Act's term for what European law calls a data controller. Vendors acting on their instructions will be processors, the equivalent of a data processor under the GDPR. The Act and the 2025 rules make the Board the body that receives breach reports within 72 hours, hears complaints from individuals, oversees consent managers and, from May 13, 2027, inquires into violations and sets penalties. Appeals against its orders go to the Telecom Disputes Settlement and Appellate Tribunal.

Members appointed late in 2026 or in early 2027 would start that work with no prior decisions, no published guidance of their own and terms capped at two years. European experience shows how much enforcement depends on regulators that can withstand challenge: about 40% of the 7.1 billion euros in GDPR fines announced over eight years has been annulled or is under challenge, according to an analysis PPC Land covered in May 2026.

Laws ahead of their regulators across the region

India is not alone in passing a privacy law faster than it staffs the body that enforces it. Indonesia's Government Regulation No. 33 of 2026, signed on July 16, 2026, sets fines of up to 2% of annual revenue and takes effect in mid-January 2027, while the regulator it depends on does not yet exist. Indonesia's communications ministry said on July 21, 2026 that the presidential regulation creating that authority was about two months from completion, as the underlying law went before the Constitutional Court. Egypt implemented its 2020 data protection law only after a five-year delay, with an executive decree signed on November 10, 2025. Vietnam brought its personal data decree into force on January 1, 2026, with a 72-hour breach notification rule.

India's version of the gap is unusual. The regulator exists in law, has a head office region, a fixed size, a pay scale and published eligibility criteria. What it does not have, a year after a two-page Gazette entry set its size, is anyone in its seats.

Timeline

Summary

Who: India's Ministry of Electronics and Information Technology, which issued the notification; the Data Protection Board of India, the regulator under the Digital Personal Data Protection Act, 2023; prospective consent managers; companies that will be data fiduciaries from May 2027; and the Kerala and Madhya Pradesh High Courts, which have already referred matters to the Board or asked about its status.

What: Gazette notification G.S.R. 845(E) set the Board at four members under Section 19(1) of the Act. MeitY later invited applications for one Chairperson and four Members on May 6, 2026, but no appointment had been announced by early November 2026. Consent manager registration under Section 6(9) and Rule 4 takes effect on November 13, 2026, with no member in post to decide applications.

When: The notification is dated November 13, 2025 and was digitally signed on November 14, 2025. The consent manager provisions start on November 13, 2026, the Kerala High Court's eight-week expectation runs to about December 2, 2026, and the main obligations and penalties start on May 13, 2027.

Where: India, with the Board's head office in the National Capital Region and its proceedings designed to run online.

Why: The Act makes the Board the body that registers consent managers, receives breach reports, hears complaints and imposes penalties of up to 250 crore rupees. Without appointed members, the provisions already in force cannot be administered, and the approach of the May 13, 2027 date leaves the regulator little time to build a record before its enforcement powers begin.