The Kerala High Court has directed the Union government to make the Data Protection Board, set up under the Digital Personal Data Protection Act, 2023, functional within eight weeks, The Hindu reported on 11 October 2026.
Quick Facts
| Bench | Chief Justice Soumen Sen and Justice V.M. Syam Kumar (Division Bench) |
| Case | A public interest litigation on passengers’ personal data at airports |
| Direction | Make the Data Protection Board functional within eight weeks |
| Laws involved | Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 |
The Petition
The petition asked the court to ensure that collection, storage, processing and transmission of passengers’ sensitive personal data at airports across India comply with the Act and the Rules. It also sought to stop airport licensees, concessionaires, service providers and intermediaries from sharing or commercially exploiting passengers’ data, or disclosing it to third parties without authority.
What the Court Said
The bench observed that the petitioner’s concerns could not be ignored, because it was found that “the privacy of citizens was being compromised”.
Digi Yatra and Aadhaar
The court had earlier directed that Digi Yatra, the portal that collects personal data at airports for identity verification, could not insist on Aadhaar to establish a traveller’s identity. The Digi Yatra Foundation told the court that a driving licence is also accepted along with Aadhaar. The bench said it expected the authorities may also consider Voter ID as valid proof in future.
Why It Matters
The Data Protection Board is the body constituted under the 2023 Act, and the High Court has now put an eight-week limit on making it functional. The Hindu’s report did not include a response from the Union government.
Featured image: The Kerala High Court building in Ernakulam (file photo). Photo by Augustus Binu, licensed under CC BY-SA 3.0, via Wikimedia Commons.