What the Kerala High Court Actually Found
The petition was filed by advocate C.R. Neelakandan, raising concerns about how Digi Yatra, the facial recognition based paperless boarding system run through the Digi Yatra Foundation under the Ministry of Civil Aviation, collects and stores biometric and travel data of passengers, with Aadhaar effectively treated as the only acceptable proof of identity for enrolment.
Earlier in the proceedings, the Division Bench of Chief Justice Soumen Sen and Justice Syam Kumar V.M. had issued notice to the Digi Yatra Foundation and asked the Union Government a direct question: had the Data Protection Board of India, provided for under Section 18 of the Digital Personal Data Protection Act, 2023, actually been constituted? The Central Government's own counsel conceded, on instructions, that the Board "has been constituted but has not [been] made functional."
Taking note of that admission, the Court observed that the privacy of citizens "is being compromised" and that the issue "cannot be ignored." It directed that the Board be made functional within eight weeks from the date of the order, and separately suggested that Voter ID could, in time, be accepted as an alternative to Aadhaar for Digi Yatra enrolment. With those directions on record, the Court disposed of the petition.
Why an Enforcement Body That Exists “On Paper Only” Matters
The Data Protection Board is not a peripheral feature of the DPDP Act, it is the Act's engine room. It is meant to receive and act on data breach intimations, adjudicate complaints from data principals against data fiduciaries, accept voluntary undertakings in lieu of proceedings, and impose the substantial financial penalties the Act contemplates for non-compliance.
Without a functioning Board, none of that machinery is actually running. Consumers whose data is misused currently have no dedicated statutory forum to approach. Businesses, for their part, have no body issuing orders, guidance notes, or settled interpretations that would help them calibrate their compliance posture with any certainty. Commentators have described this gap aptly: the Board is “established in law, absent in fact.” The Kerala High Court's order is one of the first instances of a court translating that criticism into a binding, time-bound direction.
Practical Implications for Businesses and Data Fiduciaries
The absence of a functioning Board does not suspend anyone's obligations. The DPDP Act and its Rules remain fully in force, and the duties they impose, such as valid consent, purpose limitation, data minimisation, timely breach intimation, and reasonable security safeguards, continue to apply regardless of whether an enforcement order has yet been passed against anyone. Once the Board does become operational, there is every reason to expect it will examine conduct and complaints that arose during this “dormant” period, not just conduct going forward.
The sector most directly implicated by this case, aviation and travel, should take particular note. Any business relying on biometric verification, including airlines, airport operators, hotels, and fintech KYC providers, should revisit whether its identity verification architecture offers a genuine alternative where one is reasonably available, and whether its consent and notice language can withstand the kind of scrutiny this petition invited.
What to Watch and Do Now
Businesses and compliance teams should treat the coming eight weeks, roughly through early December 2026, as a milestone worth tracking, not ignoring. We recommend using this window to complete, rather than defer, data protection impact assessments, breach response runbooks, and vendor and processor contracts that allocate DPDP obligations clearly. Entities handling biometric or other sensitive personal data should document, in writing, why their current verification method was chosen and what alternatives were considered. None of this is new advice, but an operational Board means a live backlog of complaints and a real possibility of enforcement action sooner rather than later.
Our View
A statute is only as strong as the body empowered to enforce it, and for nearly a year that body has existed mostly in name. We view the Kerala High Court's intervention as a welcome and necessary judicial nudge rather than an isolated event, and we expect other High Courts to take a similar line if the Board's inactivity persists. Our advice to clients is unchanged in substance but sharper in urgency: do not treat the Board's current silence as licence to delay. Treat the eight week deadline the Court has set for the Government as an internal audit deadline for your own organisation too.
Frequently Asked Questions
Does the Data Protection Board not being functional mean businesses do not have to comply with the DPDP Act yet?
What exactly did the Kerala High Court order?
What should businesses handling biometric or sensitive personal data do now?
If your business collects biometric, financial, or other sensitive personal data and you are unsure how exposed you are while India's enforcement infrastructure catches up, our Technology and Privacy Law team can help you assess your position and close the gaps that matter most. For related reading, see our earlier analysis of the Supreme Court's order on the Delhi internet shutdown and what it meant for business, or browse our Cyber & Data Privacy coverage for more on this practice area.