Enforcement Gaps in India’s DPDP Act and the case for decentralized data protection boards

By Abhijith Balakrishnan

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) represents a landmark effort to safeguard personal data in the world’s largest democracy. The Act establishes a Data Protection Board of India (DPB) as the central authority to enforce its provisions . However, questions have arisen about the DPDP Act’s enforcement architecture and whether it truly empowers citizens. Legal experts and civil society have already voiced alarm that the DPB, as constituted, is not autonomous, raising doubts about the adequacy of enforcement and remedies under the new law .

This report provides a detailed analysis of the DPDP Act’s structural limitations, focusing on the centralized nature of the DPB and why this design creates a significant enforcement gap. It draws parallels to enforcement under the EU’s General Data Protection Regulation (GDPR) – where a similarly centralized enforcement framework has tended to target large ...