Section 18 — DPDP Act, 2023
(1) The Central Government shall, by notification, establish a body to be known as the Data Protection Board of India to carry out the functions assigned to it under the provisions of this Act. (2) The Board shall be a body corporate by the name aforesaid, having perpetual succession and a common seal, with power to acquire, hold and dispose of property, both movable and immovable, and to contract, and shall by the said name sue and be sued.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 18 brings the Data Protection Board of India into legal existence. The Board is a body corporate — legally distinct from the Central Government, with its own legal personality. It is not a court and not a traditional regulator: it is an adjudicating authority with enforcement powers under Chapter VI. The Board has not been constituted as of October 2026 — appointments and the formal establishment notification are pending.
As a body corporate, not a civil court, the Board follows its own procedure under Section 28 — primarily digital proceedings. Its orders are enforceable as civil court decrees (Section 30), but the Board itself does not follow the Civil Procedure Code. Appeals from Board orders go to the Appellate Tribunal, not a High Court.