Rule 18: Procedure for Meetings of the Board and Authentication of its Orders, Directions, and Instruments
Statutory Text — Rule 18: Procedure for Meetings of the Board and Authentication of its Orders, Directions, and Instruments. (click to expand)
(1) The Chairperson shall fix the date, time and place of meetings of the Board, approve the items of agenda therefor, and cause notice specifying the same to be issued under her signature or that of such other individual as the Chairperson may authorise by general or special order in writing.
(2) Meetings of the Board shall be chaired by the Chairperson and, in her absence, by such other Member as the Members present at the meeting may choose from amongst themselves.
(3) One-third of the membership of the Board shall be the quorum for its meetings.
(4) All questions which come up before any meeting of the Board shall be decided by a majority of the votes of Members present and voting, and, in the event of an equality of votes, the Chairperson, or in her absence, the person chairing, shall have a second or casting vote.
(5) If a Member has an interest in any item of business to be transacted at a meeting of the Board, she shall not participate in or vote on the same and, in such a case, the decision on such item shall be taken by a majority of the votes of other Members present and voting.
(6) In case an emergent situation warrants immediate action by the Board and it is not feasible to call a meeting of the Board, the Chairperson may, while recording the reasons in writing, take such action as may be necessary, which shall be communicated within seven days to all Members and laid before the Board for ratification at its next meeting.
(7) If the Chairperson so directs, an item of business or issue which requires decision of the Board may be referred to Members by circulation and such item may be decided with the approval of majority of the Members.
(8) The Chairperson or any Member of the Board, or any individual authorised by it by a general or special order in writing, may, under her signature, authenticate its order, direction or instrument.
(9) The inquiry by the Board shall be completed within a period of six months from the date of receipt of the intimation, complaint, reference or direction under section 27 of the Act, unless such period is extended by it, for reasons to be recorded in writing, for a further period not exceeding three months at a time.
Rule 18 explains how the Data Protection Board of India (DPBI) conducts its meetings, takes decisions, and formally issues or signs its orders. It ensures the Board works in an organised, transparent, and accountable manner — similar to how other quasi-judicial bodies function in India.
1. Setting up Meetings
The Chairperson is responsible for fixing the date, time, and place of every meeting. He/She also approves the agenda — that is, the list of topics to be discussed — and signs the official notice inviting Members. If needed, he/she can authorise another officer in writing to issue such notices.
Suppose the Board needs to discuss multiple privacy-violation complaints from different companies. The Chairperson sets the meeting for Monday 10 a.m., approves the agenda (case list), and directs her office to send official notices to all Members.
2. Who Chairs the Meeting
Normally, the Chairperson leads the meeting. If he/she is absent, Members present can choose one among themselves to chair the session, ensuring the meeting still takes place. This avoids delays or cancellations when the Chairperson is unavailable.
3. Minimum Attendance (Quorum)
At least one-third of the total Members must be present for the meeting to be valid. This rule prevents a very small number of Members from taking decisions on behalf of the whole Board.
If the Board has nine Members, at least three must be present to begin official business.
4. How Decisions Are Made
All decisions are taken by majority vote of Members present. If there’s a tie — for example, 3 votes for and 3 votes against — the Chairperson (or acting chair) gets an extra or “casting” vote to break the tie.
During a vote on imposing a fine, the Board splits 2-2. The Chairperson then uses her casting vote to reach a final decision.
5. Conflict of Interest
If a Member has any personal or professional interest in a case being discussed — for example, a past relationship with the company under investigation — that Member must not participate or vote. This ensures fairness and objectivity.
Transparency builds public trust. Declaring conflicts of interest early protects both the Board and its Members from allegations of bias.
6. Emergency Decisions
Sometimes urgent situations arise where waiting for a meeting could cause harm — such as a large-scale data breach needing immediate action. In such cases, the Chairperson may act alone, recording the reasons in writing. Her decision must then be:
- Shared with all Members within seven days, and
- Formally approved (“ratified”) at the next meeting.
If a company’s servers are leaking sensitive citizen data, the Chairperson can issue an immediate suspension order without waiting for a meeting. The order is later presented to the Board for review and confirmation.
A major national e-governance platform hosting millions of Aadhaar-linked service records suffers a ransomware attack, causing exposure of personal information such as names, addresses, and partial ID numbers.
Because the breach impacts public systems and risks nationwide data misuse, the Chairperson may immediately direct the affected organisation to disable public access, initiate forensic investigation, and inform CERT-In.
The action, though taken urgently without a Board meeting, must be reported within seven days and ratified in the next session to maintain procedural transparency.
7. Decisions by Circulation
When an issue does not require discussion or a physical meeting, the Chairperson can send the proposal by circulation — usually via email or secure portal — to all Members. If a majority approve, the decision becomes valid. This method helps the Board act efficiently on routine or minor matters.
8. Authentication of Orders and Directions
Once the Board reaches a decision, the Chairperson, any Member, or an authorised officer can sign it under his/her name. This signature authenticates the order — making it an official and enforceable document.
Authentication is what gives legal effect to the Board’s decisions. Without it, an order or notice would not be valid in law.
9. Timelines for Inquiry Completion
The Board must complete any inquiry within six months from the date it receives a complaint or direction under Section 27 of the Act. If more time is genuinely needed, the Board may extend the inquiry — but only after recording the reason in writing — for a maximum of three months at a time.
If a complex cross-border data-sharing case requires extra evidence, the Board can extend the inquiry from six to nine months, clearly noting the reason in its records.
Rule 18 provides a structured way for the Data Protection Board to conduct business fairly and efficiently. It covers how meetings are scheduled, how decisions are made, what to do in emergencies, and how official orders are signed. Together, these steps ensure that every action of the Board remains transparent, accountable, and legally valid.