Rule 17 — Appointment of Chairperson and Other Members

Rule 17 is procedural rather than substantive from a business-compliance standpoint, but it matters for understanding who actually sits on the Data Protection Board of India — the body whose orders, directions and inquiries every other Rule in this series ultimately answers to. It sets out how the Board's Chairperson and other Members get selected, before the Central Government makes the final appointment.

17(1) — a separate committee recommends the Chairperson

The Central Government constitutes a Search-cum-Selection Committee specifically to recommend individuals for the Chairperson's post. It's chaired by the Cabinet Secretary, and its members are the Secretaries in charge of the Department of Legal Affairs and the Ministry of Electronics and Information Technology, plus two experts of repute with special knowledge or practical experience in a field the Central Government considers useful to the Board.

17(2) — a differently composed committee recommends other Members

A second Search-cum-Selection Committee recommends individuals for every Member other than the Chairperson. This one is chaired by the Secretary to the Government of India in the Ministry of Electronics and Information Technology, with the Secretary in charge of the Department of Legal Affairs and two experts of repute (on the same "useful to the Board" standard) as members. The Cabinet Secretary — who chairs the Chairperson-selection committee — doesn't sit on this one.

17(3) — the Central Government makes the actual appointment

Neither committee appoints anyone directly. The Central Government appoints the Chairperson or other Member after considering the suitability of the individuals the relevant committee recommended — the committees are advisory, the appointment decision itself sits with the government.

17(4) — a defect in the committee doesn't invalidate its work

No act or proceeding of either committee can be challenged merely because a vacancy or absence existed within it, or because of some defect in how it was constituted. This is a standard administrative-law safeguard — it stops an appointment from being reopened purely on a technicality about committee composition, separate from any substantive challenge to the individual selected.

Why this matters in practice

For a Data Fiduciary, Rule 17 itself creates no compliance obligation — there's nothing to implement internally here. What it does is establish the institutional legitimacy of the Board whose orders, penalties and directions the rest of the Act and Rules are enforced through. Knowing that the Chairperson and Members are selected through a defined, two-tier committee process (rather than appointed at the government's sole discretion with no intermediate recommendation step) is useful context when assessing how the Board is likely to operate — the same kind of structured, credentialed selection process used for other statutory regulators in India.

How Rule 17 connects to the rest of the Rules and the Act

Rule 17 sits alongside Rule 18, which sets the Chairperson's and Members' salary and service terms once appointed, Rule 19, which governs how the Board actually conducts its meetings, and Rule 21, which covers the Board's own officers and staff — together, Rules 17 through 21 cover the Board's full institutional machinery, distinct from the substantive compliance obligations in Rules 1 through 16 that apply to Data Fiduciaries and Data Processors.