News

Kerala High Court directs early functioning of the Data Protection Board

Written by Hirendhar Lakshmanan, Partner. 2026-10-16. 6 min read.

On 7 October 2026 the Kerala High Court closed a public interest petition about passenger data at airports. The court said it expects the Data Protection Board to be made functional within eight weeks.

The petition was about passenger data inside airports

C.R. Neelakandan, a 68-year-old resident of Thrikkakkara in Ernakulam, filed the petition in 2026 against the Ministry of Civil Aviation, the Airports Authority of India, MeitY and Digi Yatra Foundation.

He asked the court for three interim directions. The first was that the sensitive personal data of passengers at airports be collected, stored, processed and shared in strict compliance with the DPDP Act and Rules. The second was that licensees, concessionaires and service providers at airports be restrained from sharing or commercially exploiting that data. The third was that AAI's pending tenders be stayed until they carried DPDP-compliant data protection clauses.

Between March and July, the bench asked two questions

On 5 March the court issued notice to Digi Yatra Foundation and asked counsel for the Union and MeitY to find out whether a Board had been constituted under section 18 of the DPDP Act. If it had, its constitution was to be disclosed on affidavit. The petitioner was allowed to file a further affidavit on instances where passenger data had been breached.

On 15 July the bench took up identity proof. It recorded a prima facie view that a person with other proof of identity may not need to give the other details to register on Digi Yatra, and asked Digi Yatra Foundation's counsel whether another identity proof would be enough.

On 7 October, the bench closed the case in five paragraphs

Chief Justice Soumen Sen and Justice Syam Kumar V.M. said, at paragraph 2 of the order:

The issue raised by the writ petitioner cannot be ignored, as we find that the privacy of citizens is being compromised.

Counsel for Digi Yatra Foundation said Aadhaar and a driving licence can be accepted as proof of identity, and the court said it expects authorities may also consider the Voter ID. Counsel for the Union said the Board had been constituted but was not yet functional. The court said it expects the Board to be made functional within eight weeks, and disposed of the petition.

A Board with five seats and yet to become operational

2 December 2026 is eight weeks from the order.

The Board was established by notification on 13 November 2025 (G.S.R. 844(E)). A second notification fixed the number of members at four (G.S.R. 845(E)), who sit with a chairperson. MeitY invited applications for all five posts on 6 May 2026.

Answering a question in the Lok Sabha on 12 August 2026, the Government described the recruitment and named no appointees. On 7 October its counsel told the court the Board was not yet functional.

Enforcement under the DPDP Act runs through the Board

A person with a complaint first uses the business's own grievance process, and then goes to the Board.
Every personal data breach must be reported to the Board and to each person affected.
Only the Board can inquire into a breach and impose a penalty, up to ₹250 crores in accordance with the Act.
Consent managers must register with the Board. Those provisions come into force on 13 November 2026, nineteen days before the court's eight weeks run out.

Each complaint in the petition lines up with a duty in the Act

Section 6(1) requires consent that is free and limited to the data the purpose needs. It bears on which identity documents a platform can ask for. On 7 October, Digi Yatra Foundation's counsel said Aadhaar and a driving licence can be accepted.

Section 8(2) lets a business use a processor only under a valid contract, and section 8(1) keeps the business responsible for what the processor does.

Sections 8(5) and 8(7) require reasonable security safeguards and erasure once the purpose is served.

It remains to be seen how Digi Yatra will implement this.

The Act has no separate category for biometric data

Under the DPDP Act, a face scan is personal data in the same way a phone number is. The Act sets no higher tier for it.

Heavier duties for large or risky processing come through section 10. The Government may notify a business as a Significant Data Fiduciary, which then needs a data protection officer based in India, an independent data auditor and periodic impact assessments. Section 10 comes into force on 13 May 2027.

It remains to be seen whether Digi Yatra will be notified as a Significant Data Fiduciary.

Most of the Act's duties are still seven months away

11 August 2023: DPDP Act enacted
13 November 2025: Rules notified, Board established
6 May 2026: Applications invited for Board posts
7 October 2026: Kerala High Court order
13 November 2026: Consent manager provisions in force
2 December 2026: Eight weeks from the order
13 May 2027: Main duties begin

Notice, consent, security safeguards, breach reporting and the rights of data principals all commence on 13 May 2027.

Three questions the order leaves open

Can Digi Yatra Foundation insist on Aadhaar when a passenger has other proof of identity?
Do AAI's tenders for shops and counters inside terminals need data protection clauses?
Since the Court referred to alternatives, does it mean that biometrics have been frowned upon?

For teams preparing for May 2027

The Board's functionality does not move the date. A vendor contract or privacy notice drafted this year will still be in use when the duties begin, so it should be written to the Act now.

If you verify identity, accept more than one document and keep only what the purpose needs.
If vendors or concessionaires handle your customers' data, each contract needs DPDP terms.
If your notice promises deletion after a set period, build the deletion to run on that schedule.

Sources

Kerala High Court, C.R. Neelakandan v. Union of India, WP(PIL) No. 15 of 2026, orders dated 5 March 2026 and 15 July 2026, and final judgment dated 7 October 2026.
Digital Personal Data Protection Act, 2023.
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E).
Notifications G.S.R. 843(E), 844(E) and 845(E), 13 November 2025.
MeitY circular F. No. 2(1)/2026-Pers.I, 6 May 2026.
Lok Sabha Unstarred Question No. 3960, answered 12 August 2026.

Topics

This update is a general account of the law at the date shown. It is not legal advice.