Section 22

Section 22 empowers the Data Protection Board to build the human infrastructure necessary to function as an effective regulator and adjudicator. Two categories of human resource are contemplated. First, officers and other employees appointed directly by the Board — the permanent or regular staff who will process complaints, conduct inquiries, maintain records, manage the Board's digital office systems, and provide administrative support. Second, experts and consultants — including legal practitioners — engaged on terms prescribed by DPDP Rules. The expert engagement power is particularly important for a data protection authority: investigations into major data breaches, enforcement actions against sophisticated technology companies, and complex consent compliance reviews will require specialist forensic expertise, cybersecurity knowledge, and data science skills that may not be available within a permanent civil service cadre. The ability to engage external legal practitioners is significant for a body that functions as an adjudicatory authority — it may need specialised legal advice on complex jurisdiction, constitutional, or comparative law questions arising in cases. The Board's staffing model will determine its practical effectiveness. An underfunded, understaffed Board — like many Indian regulators — will struggle to handle the volume of complaints expected once the Act is fully operationalised across India's vast digital economy. India has hundreds of millions of internet users, tens of thousands of Data Fiduciaries, and a rapidly growing set of data-intensive industries.