PolityPrelimsGS2

Kerala HC gives Centre eight weeks to activate Data Protection Board

By CAShorts DeskPublished 12 October 2026, 7:43 am ISTSource: The Hindu; DPDP Act, 2023; MeitY Gazette notifications; PIB

The Kerala High Court has directed the Union government to make the Data Protection Board of India functional within eight weeks. Disposing of a PIL on airport passenger data, the court found citizens' privacy was being compromised. It had earlier ruled that Digi Yatra cannot insist on Aadhaar; a driving licence is also accepted.

Syllabus: Prelims · Polity & Governance; GS2 · Statutory & Regulatory Bodies; GS2 · Government Policies

Why it matters

An air traveller who walks through a Digi Yatra gate hands over her face as proof of identity. If an airport vendor later shares or sells that data, the law's answer is a complaint to the Data Protection Board of India, and only the Board can fine the company: civil courts cannot hear such matters. A Board that is not working leaves that traveller without the forum the law provides. The order pushes the Centre to put the enforcer in place before the law's duties bite in full. It also keeps Aadhaar a choice, not a condition, at airports. The larger question is whether the right to privacy can be enforced when the regulator is slow to start.

Prelims pointers

Data Protection Board of India: Section 18, DPDP Act, 2023; body corporate; Chairperson and Members appointed by the Central Government for two years, eligible for re-appointment.
Appeal: against the Board's orders to TDSAT, set up under Section 14 of the TRAI Act, 1997, within 60 days; TDSAT tries to decide within six months.
Penalties (Schedule): up to Rs 250 crore for security lapses, Rs 200 crore each for breach notice and children's data, Rs 150 crore for Significant Data Fiduciary duties.
Penalty sums go to the Consolidated Fund of India; a Data Principal breaching her duties may be fined up to Rs 10,000.
Data Principal rights: access to information, correction and erasure, grievance redressal and nomination; she must use the Data Fiduciary's grievance redressal before approaching the Board.
Section 39: civil courts cannot entertain suits on matters the Board is empowered to decide.
Section 44: amends Section 8(1)(j) of the Right to Information Act, 2005 (in force) and omits Section 43A of the Information Technology Act, 2000 (from May 2027).
Justice K.S. Puttaswamy v Union of India (2017): a nine-judge Bench held the right to privacy a fundamental right under Article 21.

Practise a UPSC-style question

With reference to the Data Protection Board of India, consider the following statements:

1. The Chairperson and Members of the Board are appointed by the President on the advice of the Chief Justice of India.

2. The Chairperson and Members hold office for two years and are eligible for re-appointment.

3. Appeals against the Board's orders lie before the Telecom Disputes Settlement and Appellate Tribunal.

Which of the statements given above is/are correct?

(a) 1 and 2 only
(b) 2 and 3 only
(c) 1 and 3 only
(d) 1, 2 and 3

Show the answer

Answer: (b) 2 and 3 only

1 is incorrect: under Section 19 of the DPDP Act, 2023 the Central Government appoints them; rule 17 of the DPDP Rules, 2025 adds a Search-cum-Selection Committee to recommend names. 2 is correct: Section 20 sets a two-year term with eligibility for re-appointment. 3 is correct: Section 29 sends appeals to TDSAT within 60 days.

Explainers on this topic

Right to Information Act, 2005: how the law works at 21 Polity

More from the 12 October 2026 edition

All stories of 12 October 2026

More Polity current affairs