India promised a data protection regulator. Its courts are already sending cases to it.

In an Indian courtroom, a data-protection complaint lands before a judge. The judge, scanning remedies under the Digital Personal Data Protection Act, 2023, refers the matter to the Data Protection Board of India. The referral reaches a body that cannot hear it.

The Board has no Chair and no Members. It has no secretariat and has not convened a single sitting since the rules that brought it into legal effect were notified on November 13, 2025. More than eight months later, the institution remains a body corporate in statute and an empty chair in practice. The Rules that specified the Board's operational shape, Rules 17 to 21 of the Digital Personal Data Protection Rules, 2025, took effect the same day they were notified by the Ministry of Electronics and Information Technology. Section 18 of the Act says the Board "shall" be a body corporate with a Chairperson and Members. None of those Members have been named, and the Chairperson post is vacant.

Writing in LiveLaw on 1 August 2026, Dr. Raghvendra Kumar Chaudhary argues that Indian courts are now treating the Board as an available alternate remedy in data-protection matters, even though the Board has no capacity to hear them. The litigation thesis is the columnist's reading of the case flow; the source does not name specific cases. What is documented is the consequence: referrals are reaching a body that cannot respond, and litigants are being told to wait for a forum that has not been staffed.

The architecture around the Board is a two-track selection machine. Section 19(3) of the Act requires at least one Member with legal expertise, sitting alongside specialists in data governance, dispute resolution, technology, or the digital economy. The composition is fixed at one Chairperson and four other Members. A Search-cum-Selection Committee chaired by the Cabinet Secretary, with the Secretaries of Legal Affairs and MeitY plus two outside experts, recommends the Chairperson. A second committee chaired by the MeitY Secretary recommends the Members. Both tracks have been running, on paper, since the Rules were notified.

On May 6, 2026, MeitY wrote seeking nominations for the Chairperson and Member posts, under F.No. 2(1)/2026-Pers.I. The same week, MeitY published a window advertisement for filling the Chair and Members posts in the Data Protection Board of India. A follow-up communication on June 6, 2026, addressed the appointment process again. None of those communications has yet produced a notification of appointment.

The Board is digital-by-design, not ceremonial. It is the only body with original jurisdiction to inquire into personal data breaches, issue directions on mitigation and remediation, and impose monetary penalties under the Act. The appellate route runs to the Telecom Disputes Settlement and Appellate Tribunal. With the Board inert, the only live routes for a data-protection complaint are writ jurisdiction in the High Courts, civil suits, or a referral to the Board itself. The referral is the new bottleneck.

The closure paths are procedural rather than political. The Search-cum-Selection Committee could complete its recommendation, and MeitY could issue a notification under the Rules. A legislative amendment could change the appointment mechanics, including composition or quorum. An interim arrangement, such as an acting Chairperson, a partial bench, or a MeitY-staffed temporary secretariat, could let the Board convene in a limited capacity. Each of these is a process step. None has been taken.

What the gap has produced, more than eight months after notification, is a structural mismatch between the law's promises and the institution's capacity. The DPDP Act tells data principals, the people whose data the law protects, that a body corporate is charged with enforcement. The DPDP Rules say that body shall exist. Courts are treating the body as a destination. The body has not been staffed to receive what is being sent.

The next milestone to watch is the first notification of a Chairperson appointment. Until that notification is published, the Board remains a venue on paper and a destination in orders.