Section 18 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 18 creates the Data Protection Board of India. It has three sub-sections: the Board is established from a date the Central Government notifies, it is a body corporate with perpetual succession and a common seal, and its headquarters are at a place the Government notifies. Businesses meet the Board through complaints, inquiries and penalties, so its legal character matters. A legal consultation can help you prepare for dealings with it.
Under section 18(1), "with effect from such date as the Central Government may, by notification, appoint", the Data Protection Board of India is established for the purposes of the Act. Section 18(2) makes it a body corporate with perpetual succession and a common seal, able to acquire, hold and dispose of property, contract, and sue or be sued by that name. Section 18(3) leaves its headquarters to a Government notification. The Board decides complaints and imposes penalties under later sections.
The three sub-sections
| Sub-section | Text in substance | What it means |
|---|---|---|
| 18(1) | Established with effect from a date notified by the Central Government; called the Data Protection Board of India | Creation depends on a notification, in line with section 1(2) on commencement |
| 18(2) | Body corporate; perpetual succession and common seal; may acquire, hold and dispose of movable and immovable property, contract; sues or is sued by its name | It is a legal person separate from its Members |
| 18(3) | Headquarters at such place as the Central Government may notify | Location is for the Government to choose |
Establishment by notification
The Act does not fix a date. Section 18(1) depends on a notified date, and section 2(c) defines "Board" as the Data Protection Board of India established by the Central Government under section 18. Whether and when the Board is constituted is a matter of the commencement notifications and the DPDP Rules, 2025 (notified November 2025); this article does not state a date. See section 1.
This matters in practice. The Board's powers in sections 27 and 28 and its penalty power in section 33 can only be used once the Board exists. The Act does not say what happens to a complaint filed before then.
A body corporate with perpetual succession
Section 18(2) uses the language of a corporate entity.
- Perpetual succession: the Board continues despite changes in its Members or Chairperson. Section 23(2) adds that an act or proceeding is not invalid merely because of a vacancy or a defect in the Board's constitution.
- Common seal: a formal mark for its instruments. Section 23(1) leaves the authentication of orders, directions and instruments to the manner prescribed.
- Property and contracts: it can acquire, hold and dispose of property, both movable and immovable, and contract, "subject to the provisions of this Act".
- Sue or be sued: it has legal personality before courts. Section 35 protects the Government, the Board, its Chairperson, Members, officers and employees from suit, prosecution or other proceedings for anything done or intended to be done in good faith under the Act. See sections 34 to 36.
What the Board does, in outline
Section 18 only establishes the Board. Its work is set out later.
- Section 27: directing urgent remedial measures on a breach intimation, inquiring on complaints and references, and imposing penalties. See section 27.
- Section 28: functioning as an independent body and, as far as practicable, as a digital office, with inquiry under natural justice. See section 28.
- Section 31: directing parties to mediation.
- Section 32: accepting voluntary undertakings.
- Section 33: imposing monetary penalties from the Schedule.
An order or direction of the Board can be challenged by appeal to the Appellate Tribunal under section 29. See section 29. Section 39 bars civil courts from entertaining a suit or proceeding on any matter for which the Board is empowered.
Independence
Section 28(1) says the Board "shall function as an independent body". Section 18 itself does not use the word. The structural features that support independence in the text are the fixed terms and protection of conditions in section 20 and the bar on removal without a hearing in section 21(2). The Government, however, appoints the Chairperson and Members (section 19(2)), prescribes their terms (section 20(1)), approves the appointment of the Board's officers (section 24) and may call for information from the Board (section 36). The Act leaves the balance there without further comment.
What a business should take from this
- The Board is the main regulator for this Act. Complaints about a personal data breach or non-observance of obligations are inquired into by it.
- Expect a digital process. Section 28(1) contemplates digital receipt of complaints and digital hearings.
- Keep records in a form you can produce. The Board can inspect data, books and documents and summon persons (section 28(7)).
- Do not assume that a civil court is an alternative route. Section 39 closes that door for matters within the Board's power.
Example
A customer complains to a company about how it handled her data. She first uses the company's grievance route (section 13(3) requires her to exhaust it). If unresolved, she may approach the Board. The Board, as a body corporate, issues orders in its own name, and the company's challenge lies to the Appellate Tribunal, not a civil court.
What section 18 does not say
- It does not give a date or a number of Members; section 19(1) leaves the number to notification.
- It does not name the headquarters.
- It does not say the Board is a court. It is a regulator with civil court powers for specified matters (section 28(7)).
- It does not set out the Board's budget or funding.
Need help preparing for dealings with the Board?
Complaints, inquiries and orders follow a set route and record-keeping is where many businesses are weakest. Our legal consultation team can help you set up response procedures and evidence files so you are ready if the Board calls.
Key takeaways
- Section 18 establishes the Data Protection Board of India from a notified date.
- It is a body corporate with perpetual succession, a common seal and power to sue and be sued.
- Its headquarters are to be notified.
- Its functions are in sections 27 to 33.
- Civil courts are barred from its matters (section 39).
Read next
- Data Protection Board of India: section 18 overview
- Sections 19 to 21: Board composition, terms and disqualification
- Section 27 of the DPDP Act, 2023: powers and functions of the Board
- Section 1 of the DPDP Act, 2023: short title and commencement
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.