India's data protection framework now has a statute, a set of rules, a designated adjudicatory body, and a growing body of case law referring litigants to that body. What it does not have, eight months after the rules were notified, is a functioning regulator. The Digital Personal Data Protection Rules, 2025, were notified by the Ministry of Electronics and Information Technology on November 13, 2025, bringing into immediate effect the provisions establishing the Data Protection Board of India under Section 18 of the Digital Personal Data Protection Act, 2023. Rules 17 to 21, governing the Board's constitution, procedure, and terms of service, took effect the same day. Yet as of this month, the Board has no appointed Chairperson and no appointed Members. It exists, in the strict sense, only as a statutory possibility.

This is not merely a staffing delay. It has begun to intersect with live litigation in a way that exposes an uncomfortable structural problem: courts are treating the Board as an available, efficacious alternate remedy, while the Board itself remains institutionally inert.

A Regulator on Paper

The DPDP Rules, 2025, set up a two-track selection process. A Search-cum-Selection Committee chaired by the Cabinet Secretary, joined by the Secretaries of Legal Affairs and Ministry of Electronics and Information Technology (MeitY) along with two outside experts, was tasked with recommending the Chairperson. A second committee, chaired by the MeitY Secretary and including the Secretary of Legal Affairs and two experts, was tasked with recommending the other Members. Section 19(3) of the Act requires that at least one Member have expertise in law, alongside domain knowledge in data governance, dispute resolution, technology, or the digital economy.

The government has not been silent on this front. A communication dated May 6, 2026, addressed to the Secretaries of all Union Ministries and Departments, the Chief Secretaries of every State and Union Territory, and MeitY's attached and subordinate offices, sought nominations relevant to filling the Chairperson and Member posts. A further notification followed on June 6, 2026, again concerning the appointment process. The paper trail shows a government actively working through the mechanics of selection. What it does not show, even now, is an actual appointment. The Search-cum-Selection Committees appear to remain at the stage of soliciting names rather than finalising them.

This distinguishes the present moment from the criticism the delay attracted earlier in the year. Commentary in April treated the absence of appointments as a symptom of bureaucratic inertia in constituting the selection committees themselves. That description is now dated. The committees exist, the process has visibly moved, and the vacancy persists regardless. The problem has shifted from formation to velocity: a machinery that is running, but not yet producing an output that anyone outside government can rely upon.

When Courts Refer Litigants to an Empty Chair

The clearest illustration of what this means in practice came from the Madhya Pradesh High Court's Indore Bench. In Parth Sharma v. Union of India, a petitioner approached the High Court under Article 226 challenging Instagram's proposed discontinuation of end-to-end encrypted messaging, framing the platform's move as an infringement of the right to privacy recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India. The Union of India's counsel raised a preliminary objection: since Section 18 of the DPDP Act constitutes a dedicated Board to adjudicate exactly this category of grievance, the petitioner had failed to exhaust the statutory remedy available to him.

The Division Bench of Justice Vijay Kumar Shukla and Justice Alok Awasthi accepted the objection. Without examining the merits of the privacy claim, the Court directed the petitioner to file a representation before the Board within seven days, and directed the Board to decide the matter through a reasoned, speaking order within fifteen days, after affording a hearing. The Board's decision was to be placed before the Court at the next hearing, preserving the petitioner's access to judicial review while insisting, first, on the statutory route.

As a matter of doctrine, this is an entirely conventional application of the rule that constitutional courts should ordinarily decline writ jurisdiction where an efficacious statutory remedy exists. What makes the order significant is what it necessarily assumes: that the Board, as of April 2026, was capable of receiving a representation, conducting a hearing, and issuing a reasoned order within a fortnight. On the available public record, no Chairperson or Member had been appointed at that time, and none has been appointed since. The Board that the High Court directed the petitioner toward was, functionally, unstaffed.

The Exhaustion Doctrine Meets a Non-Existent Forum

Indian courts have long carved out an exception to the exhaustion-of-remedies principle where the alternate forum is not, in fact, efficacious whether because of procedural inadequacy, absence of independence, or plain unavailability. The difficulty the DPBI situation presents is that it does not fit neatly into the categories courts have previously considered. This is not a case of a sluggish or biased tribunal; it is a case of no tribunal at all in any operative sense. A Board with no Members cannot convene a bench, cannot hear a party, and cannot sign an order, reasoned or otherwise. Directing a litigant to such a body does not so much enforce the statutory scheme as suspend the litigant's grievance in a procedural holding pattern, with no institutional actor obliged, or indeed able, to move it forward within the timeline the Court has set.

There is a genuine institutional-competence argument for restraint here: courts cannot compel appointments to a specialised body, and it would be awkward for a constitutional court to assume the Board's adjudicatory function by default. But the alternative carries its own cost. If the Board fails to decide within the window set, does the petitioner's right to be heard revive automatically, or must he seek an extension, or file a fresh writ? The order does not say, because the scenario it did not anticipate was a Board unable to act at all.

Puttaswamy's Unfinished Institutional Promise

The nine-judge Bench in Puttaswamy held privacy to be intrinsic to Article 21, but the judgment was equally emphatic that the right would require a statutory architecture to be made real in the ordinary lives of citizens confronting state and private data practices. The DPDP Act was, avowedly, Parliament's answer to that call. An Act whose enforcement organ remains unstaffed nearly three years after assent, and eight months after its operative rules were notified, risks converting that constitutional promise into a textual one. The right exists; the forum meant to vindicate it, in the ordinary case that does not reach a constitutional court, does not yet function.

This gap also has consequences well beyond individual grievances like the one in Indore. Section 8(6) of the Act requires Data Fiduciaries to intimate personal data breaches to the Board; Sections 27 and 33 empower the Board to inquire into non-compliance and levy penalties running up to ₹250 crore; and the entire Consent Manager ecosystem, whose registration window opens in November 2026, falls under the Board's regulatory oversight. Every one of these mechanisms presumes an adjudicator capable of receiving, inquiring into, and acting on the information it is designed to generate. None of it can function as intended while the Board remains a body corporate on paper alone.

A Comparative Aside

It is worth noting how unusual this sequencing is by comparative standards. When the General Data Protection Regulation came into force across the European Union in May 2018, it did so against a backdrop of national data protection authorities that had, in most Member States, existed and functioned for years before the Regulation's obligations became enforceable. The United Kingdom's Information Commissioner's Office predates the GDPR by over three decades. India has, in effect, inverted that sequence: the substantive rights and penalty structure were notified first, and the regulator meant to operationalise them was left to catch up. That inversion may trace to legislative design choices made years earlier, but its consequences are now visible in live litigation, not merely in academic critique.

What This Moment Calls For

None of this is an argument against the exhaustion principle, nor a case for courts to abandon deference to specialised tribunals. It is a case for courts, and indeed the government, to treat the Board's non-operational status as a live fact rather than a formality to be assumed away. Until the Search-cum-Selection Committees actually produce appointments, orders directing petitioners to the Board should perhaps build in an express fallback: a right to revert to the High Court forthwith if the Board fails to constitute itself and act within the stipulated period, rather than leaving that contingency for the petitioner to litigate afresh. For the executive, the more direct answer is the obvious one: two rounds of notifications inviting nominations, spread across May and June, indicate movement, but movement is not appointment. Every month of delay is a month in which India's data protection statute exists in name only for the ordinary citizen whose recourse runs, by design, not to a constitutional court but to a Board that has yet to acquire a single Member.

Author is an Assistant Professor at School of Law, CHRIST (Deemed to be University), Delhi NCR Campus. Views are personal.