INSTITUTIONAL EFFICACY OF THE DATA PROTECTION BOARD OF INDIA UNDER THE DPDP FRAMEWORK: A HUMAN RIGHTS ANALYSIS

Abstract

The Digital Personal Data Protection Act, 2023, read with the Digital Personal Data Protection Rules, 2025, is the legislative response to informational privacy as a fundamental right recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India, and to India's obligation under Article 17 of the International Covenant on Civil and Political Rights, 1966. Academic focus has centred on the content of that response how consent is obtained, which governmental activities are exempted, and the amendment of the Right to Information Act, 2005. This article shifts the focus from substance to structure, and assesses the Data Protection Board of India against human rights benchmarks for oversight institutions rather than against data protection benchmarks alone. It argues that the Board has been constituted as an adjudicatory office and not as a regulatory authority, and that this formative choice regardless of any inadequacy in the rights conferred is the primary threat to the efficacy of the Indian regime. The analysis follows several vectors: want of structural independence, arising from appointment through executive-constituted committees, two-year renewable terms, and service conditions drawn from the Central Civil Services (Classification, Control and Appeal) Rules, 1965; the absence of power to make subordinate legislation, codes or binding guidance; the remedial void created by crediting penalties to the Consolidated Fund of India and omitting section 43A of the Information Technology Act, 2000 without replacement; the bar on civil courts; a procedural framework inconsistent with tribunalisation jurisprudence; and an asymmetric relationship with an executive that appoints, funds, staffs, disciplines and may exempt itself. Each defect is mapped onto an established human rights standard: the Principles relating to the Status of National Institutions, 1993 (Paris Principles) on composition, tenure and funding; Article 8 of the Universal Declaration and Article 2(3) of the ICCPR on the right to an effective remedy, with the public law compensation jurisprudence from Rudul Sah and Nilabati Behera; the legality and proportionality standards governing state interference with privacy; and the access-to-remedy pillar of the United Nations Guiding Principles on Business and Human Rights, 2011, whose effectiveness criteria for non-judicial grievance mechanisms the Board largely fails to satisfy. Drawing on the GDPR supervisory-authority model, the reconstituted United Kingdom regulator, the Singaporean Commission and the conversion of Brazil's ANPD into an autonomous authority, the article proposes reforms calibrated to the transition period closing in May 2027. Its conclusion is that a right recognised as both constitutional and internationally guaranteed has been paired with an institution structurally incapable of vindicating it.