Delhi High Court Questions Centre On Implementation Of Digital Personal Data Protection Act

The legislation paves way for processing digital personal data in a manner that protects both— individuals' right to privacy and the need to process their personal data for lawful purposes.

However, despite receiving Presidential assent on August 11, 2023, the Act is yet to be notified.

The Petitioner, a working professional, has invoked the High Court's writ jurisdiction seeking a mandamus directing the Centre to notify the Act.

The plea claims that without implementation of the DPDP Act, businesses engage in unethical practices and compromise personal data of individuals, without proper consent.

According to the DPDP Act, personal data can be processed only after taking the consent and for certain “legitimate uses”. “Personal data” is defined under the Bill as “any data about an individual who is identifiable by or in relation to such data.”

Significant to note that as per Section 1(2) of the Act, it shall come into force with effect from the date to be notified by the Central Government. It further provides that different dates may be appointed for different provisions of this Act to come into force.

The Court was however informed that no such notification has been issued yet.

As such, a division bench comprising Chief Justice DK Upadhyaya and Justice Tushar Rao Gedela directed,

“Let the said fact be verified by the learned counsel representing the Union of India who shall seek instructions not only in respect the fact that as to whether any notification under Sub Section (2) of Section 1 of the said Act has been issued but also as to whether any such notification is in contemplation.”

The matter is now listed on November 12.

The DPDP Act, when notified, will apply to the processing of digital personal data within the territory of India where the personal data is collected in digital form or in non-digital form and digitised subsequently.

It will also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services “to Data Principals within the territory of India.”

The law requires establishment of the Data Protection Board of India by the central government. It will monitor compliance and imposition of penalties, direct data fiduciaries to take necessary measures in the event of a data breach and hear grievances made by affected persons.

Appearance: Ms. Shyel Trehan, Sr. Adv. with Ms. Vidhi Jain, Mr. Manish Kaushik, Mr. Mishal Johari, Mr. Vikas Ashwani and Mr. Chirag Sharma, Advs. for Petitioner; Mr. Ishkaran Singh Bhandari, CGSC with Mr. Piyush Yadav, Advs. for R-1. Mr. Rajshekhar Rao, Sr. Adv. with Mr. Rachit Bahl, Ms. Sayobani Basu, Ms. Dhriti Batra and Ms. Ishi Rohatgi, Advs. for R-2 and R-3. Mr. Pratham Agarwal and Mr. Saigal, Advs. for R-6.

Case title: Vikas Mittal v. Union of India

Case no.: W.P.(C) 14344/2025

Click here to read order