Make Data Protection Board active in 8 weeks: HC tells Centre

1. At a Glance

• The Kerala High Court has directed the Union government to make the Data Protection Board (DPB) functional within eight weeks. The Board was constituted under the Digital Personal Data Protection (DPDP) Act, 2023 [1].
• The DPB is the adjudicating and enforcement body of India's data-protection law. It can inquire into breaches, issue directions and impose monetary penalties [5].
• The case arose from airport biometric/identity processing (Digi Yatra). It links the right to privacy, Aadhaar-based identity, and judicial pressure on the executive to implement a law it has already passed [1].
• It matters for UPSC in two ways. It is current affairs: an HC mandamus-style direction on a statutory body. It is also static: the DPDP Act and Rules, the Board's composition, penalties and appeals.

2. Why in the News

• A Division Bench of the Kerala HC gave the 8-week direction while disposing of a PIL. The PIL wanted the collection, storage, processing and transmission of passengers' sensitive personal data at airports to comply strictly with the DPDP Act, 2023 and the DPDP Rules, 2025 [1].
• The court found that citizens' privacy was being compromised, so the petitioner's concerns "could not be ignored" [1].
• Earlier, the court had directed that Digi Yatra could not insist on Aadhaar to establish a traveller's identity [1].
• Reported in The Hindu, Chennai edition, 12 October 2026, p. 9 [1].

3. Background & Evolution

• Aug 2023: PIB released the salient features of the DPDP Bill, 2023 [8].
• 11 Aug 2023: The President gave assent, enacting it as Act No. 22 of 2023 [6][7].
• Section 18 of the Act provides for establishing the Board. The Board comes into being only from a date the Central Government notifies [6][7].
• Jan 2025: The Draft DPDP Rules were released for consultation [9].
• 13/14 Nov 2025: The DPDP Rules, 2025 were notified. They fully operationalise the Act and allow an 18-month phased compliance period [2][3][4].
• Later (date not confirmed in sources): A MeitY document says the Government has established the DPBI under Section 18 [5].
• Oct 2026: The Kerala HC directed that the Board be made functional within 8 weeks [1]. The Board exists on paper, but the court wants it working.

4. Core Static Facts

• Key terms: Data Fiduciary is the entity that decides the purpose and means of processing. Data Principal is the individual the data relates to. Personal data breach [7].

5. Multi-Dimensional Analysis

Legal / Constitutional

• The HC direction uses writ jurisdiction in a PIL to make the executive operationalise a statutory regulator [1].
• The court treated the DPDP Act and Rules as the benchmark of legality for airport data processing [1].
• Restricting mandatory Aadhaar for Digi Yatra reflects proportionality and voluntariness in identity verification [1].

Governance / Administrative

• There is a gap between paper and practice. The Rules were notified and the Board was reportedly established [2][5], yet the court found it not functional [1].
• Without a working Board, Data Principals have no forum for grievance redress under the Act, and the penalty provisions cannot be enforced [2][5].
• Under the 18-month phased compliance model, the obligations on fiduciaries tighten over time. That makes the Board's readiness urgent [2].

Scientific / Technological

• Digi Yatra collects personal data at airports to verify identity [1]. This is biometric and facial data, which carries high risk if breached.
• A digital-by-design Board with online complaint filing and tracking means less paperwork and faster adjudication [5].

Ethical / Social

• Insisting on Aadhaar excludes people who do not have it or do not want to use it. The court noted that a driving licence is accepted and expects Voter ID to be considered as well [1].
• The higher penalty tier for children's data obligations (₹200 crore) shows extra protection for vulnerable Data Principals [2].

Economic

• Penalties of up to ₹250 crore strongly deter weak security practices [2].
• Legal certainty from a functioning regulator also matters for the digital economy and for compliance planning.

6. Recent Developments (last 12–18 months)

• 13/14 Nov 2025: DPDP Rules, 2025 notified. They provide for the Board (Chairperson + 4 Members) and for appeals to TDSAT [2][3][4].
• 2026 (MeitY document, uploaded May 2026): MeitY reports that the DPBI has been established under Section 18 [5].
• Before Oct 2026: The Kerala HC barred Digi Yatra from insisting on Aadhaar. Digi Yatra Foundation told the court that a driving licence is also accepted [1].
• Oct 2026: The Kerala HC Division Bench directed the Centre to make the DPB functional within 8 weeks [1].

7. Prelims Hooks

• The DPDP Act, 2023 is Act No. 22 of 2023. It received Presidential assent on 11 August 2023 [6][7].
• The Data Protection Board of India is established under Section 18 of the DPDP Act [5].
• The Board has a Chairperson and four Members [2][6].
• Members are chosen through a Search-cum-Selection Committee [2].
• Appeals against the Board's decisions go to TDSAT, not to a High Court or the NCLAT [2][3].
• The DPDP Rules, 2025 give an 18-month phased compliance period [2][3].
• The highest penalty is ₹250 crore, for failing to maintain reasonable security safeguards [2].
• Failing to notify the Board or affected persons of a data breach can attract up to ₹200 crore [2].
• Breaching obligations relating to children's data can attract up to ₹200 crore [2].
• Any other violation by a Data Fiduciary can attract up to ₹50 crore [2].
• The DPBI is described as a "digital-by-design" institution with online complaint filing [5].
• Nodal ministry: MeitY [5].
• The Kerala HC ruled that Digi Yatra cannot insist on Aadhaar for identity verification [1].

8. Can a Board Chosen by the Government Judge the Government?

• The members' term is short, and they can be reappointed
• Members of the Data Protection Board serve for only two years [6].
• A member who wants a second term may avoid ruling against the government that will decide on it. PRS says this "may affect independent functioning of the Board" [6].

• In Rojer Mathew (2019), the Supreme Court said that a short term together with reappointment "increases influence and control of the Executive" [6].

• Other regulators get longer terms

• SEBI and CCI (Competition Commission of India) members serve five years. TRAI members serve three [6].

• The body that must protect citizens from both companies and the State has the weakest tenure of these.

• The Act does not fix the Board's structure. The government fills it in by Rules

• Under the 2019 Bill, the selection committee was to be chaired by the Chief Justice of India or a Supreme Court judge [10].
• The Joint Parliamentary Committee (JPC) wanted to add the Attorney General, an independent expert, and the Directors of an IIT and an IIM [12].
• From the 2022 draft onwards, the Board's composition, appointments and removal were left to the Central Government to prescribe [11].

• PRS asked whether these details belong in the Act itself if the Board is to stay independent [11].

• Why this matters for the Kerala case

• The court can make the Board start working. It cannot make the Board independent.
• Many complaints will be about data held or processed by public bodies. A Board that depends on the executive for its members' terms will find such cases hard to decide fairly.

9. What the Board Cannot Touch: The State's Own Use of Data

• The government can exempt its own agencies
• The Act lets the Central Government exempt processing by government agencies from any or all provisions [6].

• Once an agency is exempt, a citizen has no complaint to take to the Board. A working Board does not change that.

• Government bodies can keep data for as long as they like

• For government entities, storage limitation (deleting data once its purpose is over) and the citizen's right to erasure do not apply [6].

• PRS warns that this could let an agency build a "360-degree profile" of a person for surveillance [6].

• India has no rulebook for how exempt processing is checked

• For phone-tapping, the PUCL judgment (1996) required necessity, purpose limitation and storage limitation [6].

• PRS notes that "India does not have any such legal framework" for data processing that has been exempted [6].

• What the UK does differently

• Under the UK's Investigatory Powers Act, 2016, the Secretary of State issues a warrant, a Judicial Commissioner must approve it, and Parliament oversees the system [6].

• India's law has no step like this [6].

• India's own expert committee wanted narrower exemptions

• The Srikrishna Committee (2018) said that even for national security and crime prevention, the duties of "fair and reasonable processing and security safeguards" should still apply [6].

10. What a Working Board Still Cannot Give the Citizen

• No compensation for the person harmed
• The Act does not regulate harm that comes from processing personal data [6].
• The EU's GDPR (General Data Protection Regulation) gives the affected person a right to compensation (Article 82) [6].

• So the Board can fine a company up to ₹250 crore [2], but the traveller whose face scan leaks gets no remedy for their own loss under this law.

• Rights missing from the Act

• The Act provides no right to data portability (taking your data to another service). GDPR provides it under Article 20 [6].

• The Srikrishna Committee said portability "must be guaranteed" wherever it does not expose trade secrets [6].

• Consent is weaker for state services

• For benefits, licences and certificates, the Act removes purpose limitation (using data only for the purpose it was collected for). PRS says this could allow profiling [6].
• Identity checks such as Digi Yatra sit close to this zone. That is why the court's insistence on choice (driving licence or Voter ID instead of Aadhaar) matters [1].

11. Is the Court Doing the Executive's Job? The Overreach Argument

• The strongest case against the order
• Parliament wrote that the Board comes into being only from a date the Central Government notifies [6][7]. Timing was left to the executive on purpose.
• The Rules allow an 18-month phased compliance period [2]. The government chose a slow rollout so that companies have time to prepare.

• A fixed 8-week deadline from a court replaces that policy choice with the court's own timetable.

• Why the order still stands up

• The court did not design the Board or pick its members. It asked that a body the government says it has already established [5] be made to actually work [1].
• Once Rules are notified and the Board is created, running it is a statutory duty (a duty the law places on the government), not a policy choice. A writ of mandamus (a court order telling an authority to perform a duty it is legally bound to perform) exists for exactly this situation.

• The court found that citizens' privacy was being compromised right now at airports [1]. Without a Board, that harm has no forum where it can be heard under the Act.

• What the critics get right

• A Board rushed into action within 8 weeks may begin work with weak capacity.
• A court order cannot fix the Board's short tenure or the government exemptions. Only Parliament or MeitY can change those.

12. Who Should Fix What

• Parliament should write the Board's term and selection process into the Act
• Today these details are left to Rules the government makes and can change [11].

• The 2019 Bill had a judge-led selection committee [10], and the JPC wanted it widened further [12]. Either model is a ready template.

• MeitY should give members a longer term with no reappointment

• Two years with reappointment is what Rojer Mathew warned against [6].

• A five-year term, as in SEBI and CCI [6], would protect members from pressure.

• Parliament should add oversight for government exemptions

• It can follow the UK's Investigatory Powers Act model: a warrant, judicial approval and parliamentary review [6].

• It can apply the PUCL tests of necessity, purpose limitation and storage limitation to exempted processing [6].

• MeitY should add a compensation route for affected individuals

• It can follow GDPR Article 82 [6], so that a Board finding helps the victim and does not just collect a fine.

13. Anchors for Answers

• Data: Board members serve a 2-year term with reappointment, against 5 years for SEBI and CCI and 3 years for TRAI [6]
• Data: Maximum penalty is ₹250 crore, for failing to keep reasonable security safeguards [2]
• Report/Committee: Justice B.N. Srikrishna Committee, 2018: narrow exemptions, strong rights for Data Principals, guaranteed portability [6]
• Report/Committee: Joint Parliamentary Committee on the PDP Bill, 2019: proposed adding the Attorney General, an independent expert and IIT/IIM Directors to the selection panel [12]
• Law/Case: Rojer Mathew (2019): a short term plus reappointment increases executive control over tribunals and regulators [6]
• Law/Case: PUCL (1996): surveillance must meet necessity, purpose limitation and storage limitation [6]
• Comparison: EU GDPR gives a right to compensation (Art. 82) and portability (Art. 20). India's Act gives neither [6]
• Comparison: The UK Investigatory Powers Act, 2016 requires a Judicial Commissioner's approval and parliamentary oversight for state access to data [6]
• Scheme: Digi Yatra: facial-recognition boarding at airports, where the HC barred mandatory Aadhaar [1]

14. Mains Relevance

• GS-II: Statutory, regulatory and quasi-judicial bodies; government policies and interventions; judicial activism and the role of the judiciary.
• GS-III: Cyber security; IT and data governance; challenges to internal security through communication networks.
• GS-IV: Privacy as an ethical value; accountability in governance.
• Possible Mains question stems: 1. "A law is only as effective as the institution that enforces it." Examine this in the context of the Data Protection Board under the DPDP Act, 2023. 2. Discuss the privacy concerns in facial-recognition-based services such as Digi Yatra. How far does the DPDP framework address them? 3. Critically evaluate the role of courts in compelling the executive to set up statutory regulators. Does this amount to judicial overreach?

15. Related Topics to Study Next

• Right to privacy as a fundamental right (Article 21): This is the constitutional basis of the DPDP law.
• Aadhaar and voluntariness of authentication: This links directly to the HC's bar on mandatory Aadhaar for Digi Yatra [1].
• TDSAT: It is the appellate forum for the Board's decisions [2].
• IT Act, 2000 and CERT-In: They form the parallel cyber-security and breach-reporting regime.
• Digi Yatra and facial recognition technology: This is the immediate subject matter of the PIL [1].
• RTI Act and the DPDP amendments: This is a debate about how privacy and transparency interact.
• EU GDPR: It is the comparative benchmark for India's data-protection design.

16. NCERT Concepts to Revise

• Data Protection Board of India (Polity): This is the body the court wants made functional; it handles breaches, penalties and appeals to TDSAT.
• Digital Personal Data Protection Act 2023 (Polity): The parent law that creates the Board, sets duties for data fiduciaries and rights for data principals.
• Right to privacy (Polity): Privacy as a fundamental right under Article 21 is the constitutional basis for the data-protection law and the PIL.
• Writ jurisdiction (Polity): The High Court used its Article 226 powers to direct the Centre to act on a statutory body.
• Judicial activism (Polity): Courts pushing the executive to implement a law raises activism versus overreach, a likely Mains theme.
• Aadhaar (Polity): The court barred Digi Yatra from insisting on Aadhaar, so understanding Aadhaar's purpose and voluntariness helps.

17. Common Errors / Trap Areas

• Appellate body: It is TDSAT, not the NCLAT or a High Court [2].
• Notification date of the Rules: Sources differ between 13 and 14 November 2025 [2][4]. Learn "November 2025".
• Penalty tiers: The ₹250 crore cap is for security-safeguard failure, not for children's data, which is capped at ₹200 crore [2].
• "Constituted" vs "functional": The Board was reportedly established under Section 18 [5], but the HC ordered that it be made functional [1]. Do not mark it as "not yet constituted".
• Court: The order came from the Kerala High Court (Kochi), not the Supreme Court or the Madras HC, even though the story appeared in the Chennai edition [1].