Kerala High Court Expects Data Protection Board to Be Functional Within Eight Weeks

A division bench of the Kerala High Court, comprising Chief Justice Soumen Sen and Justice Syam Kumar V.M., has disposed of the public interest litigation on the Digi Yatra programme with an expectation that the Data Protection Board of India will start functioning within eight weeks. In C.R. Neelakandan v. Union of India (WP(PIL) No. 15/2026), reported by LiveLaw on 10 October 2026, the bench said it expected the Board "will be made functional within a period of eight weeks from date". The Court also found that the petitioner's concerns about passenger privacy could not be ignored.

The order answers a question the same bench put to the Centre in March, when it issued notice to the Digi Yatra Foundation and asked whether the Board had been constituted. Counsel for the Union has now told the Court, on instructions, that the Board has been constituted but is not yet functional. That matches the public record. The Centre notified the Board's establishment through G.S.R. 844(E) on 13 November 2025, and MeitY invited applications for the posts of Chairperson and four Members in May 2026, but no appointment has been publicly notified.

The timing matters. Section 6(9) of the DPDP Act and Rule 4 of the DPDP Rules, 2025 come into force on 13 November 2026. From that date, a Consent Manager must be registered with the Board, and the Board must inquire into each application before it registers anyone. A Board without a Chairperson or Members cannot do that, so the consent manager regime will begin on paper with no regulator to admit anyone into it. The Court chose the language of expectation rather than a writ of mandamus, and it closed the case, which leaves no pending matter in which to test compliance. I would argue the order still carries weight, because a constitutional court has now recorded the Centre's own admission that the Board does not function.

For data fiduciaries, the absence of a working Board is no reason to slow down. The obligations that start in May 2027 do not depend on when the Board is staffed, and courts are already reading the DPDP Act into disputes about personal data before its enforcement machinery exists. Operators of biometric and identity systems, at airports and elsewhere, should expect more petitions of this kind.