Section 18 — Establishment of Board

Everything the rest of Chapters V and VI describe — composition, procedure, powers, penalties — assumes a Board already exists to hold them. Section 18 is where that existence is created. It doesn't describe what the Board does; Section 27 handles that. It describes what the Board is.

A Board created by notification — 18(1)

The Board is established with effect from whatever date the Central Government notifies, for the purposes of the Act, and is to be called the Data Protection Board of India. The Act's passage into law and the Board's actual existence are two separate events — the Board only comes into being once this specific notification is issued, which is also why Rule 1(2) of the DPDP Rules, 2025 was the provision that brought the rules on setting up the Board into force immediately upon notification, well ahead of the Act's substantive obligations.

Legal status as a body corporate — 18(2)

The Board is a body corporate by the name aforesaid, with perpetual succession and a common seal, and — subject to the Act's other provisions — the power to acquire, hold and dispose of property, both movable and immovable, to enter into contracts, and to sue or be sued in its own name. This is the same legal architecture used for most Indian statutory regulators: an institution that survives changes in its own membership, and that can be a party to litigation in its own right rather than only through the government that created it.

Headquarters fixed by notification — 18(3)

The Board's headquarters sit at whatever place the Central Government notifies. The Act doesn't fix a location itself, leaving that detail — like the Board's start date and, as later sections show, much of its composition and procedure — to be filled in by executive notification rather than spelled out in the statute.

Why this matters in practice

Section 18 is largely a formalities section, but the pattern it sets — substantive detail left to notification and Rules rather than fixed in the Act itself — repeats across the rest of this chapter. Anyone trying to understand how the Board will actually operate needs to read the Act's framework alongside whatever the Central Government has separately notified, rather than expecting the Act's text alone to answer every operational question.

Illustration: if a Data Fiduciary wanted to challenge a penalty the Board imposed on procedural grounds — say, arguing the Board lacked capacity to be sued — Section 18(2)'s body-corporate status is what forecloses that argument outright: the Board can sue and be sued in its own name, independent of whether that specific challenge on the merits succeeds.

How Section 18 connects to the rest of the Act

Section 19 fills in who sits on the Board once it exists; Section 27 sets out what it actually does; Section 28 governs how it conducts inquiries. Our FAQs cover the Board's establishment and powers together in one answer, since in practice organisations usually want to know both at once — what the Board is, and what it can actually do to them.