HC seeks govt reply on operationalising DPDP Act
The Delhi High Court questioned the Union government on the delayed implementation of the Digital Personal Data Protection Act, 2023, amid data breach concerns.
New Delhi: The Delhi high court on Wednesday sought to know from the Union government whether it has issued a notification or was contemplating one to notify the rules under the Digital Personal Data Protection (DPDP) Act, 2023.
The DPDP, the long-awaited data protection law, was given presidential assent on August 12, 2023, but the Act is yet to be implemented as the corresponding rules haven’t been notified. Earlier this year, the Centre released Draft DPDP Rules, 2025 for public consultation to operationalise the 2023 law. The government had informed Parliament in July that the draft rules received 6,915 inputs from various stakeholders.
A bench comprising chief justice DK Upadhyay and justice Tushar Rao Gedela was hearing a petition filed by one Vikas Mittal, a working professional victim of alleged data breach, seeking directions to the Centre to notify the rules under the DPDP Act.
The petitioner, represented by senior advocate Shyel Trehan along with advocates Manish Kaushik and Mishal Johari, alleged that in the absence of the implementation of the DPDP law, certain organisations were engaging in unethical practices such as collecting, copying, analysing, and disseminating personal data of individuals without proper authorisation or consent.
The court, however, expressed its inability to issue any directions in the absence of a formal notification enforcing the law. “As of today, the act has not come into force. How can we pass an order? ...” the bench remarked.
It asked the government’s counsel to clarify the Centre’s position on whether it intended to bring the law into force. The Centre’s counsel sought additional time to respond, which the court granted and posted the matter for hearing on November 4.
“We have been informed that no such notification (for the act to come into force) has been issued. Let the said fact be verified by the counsel for the Union of India. He shall also seek instructions whether any notification has been issued, but also whether any such notification is in contemplation,” the court said in its order.
In his petition, Mittal accused e-commerce platform GoKwik of unlawfully collecting consumer data by using technologies such as cookies without explicit consent and disseminating to online merchants such as Lenskart.
“Such unregulated misuse of data endangers public confidence in the e-commerce platforms who, on the pretext of providing service, probably are profiling millions of individuals along with the petitioner, and the procurement of digital personal data by GoKwik puts these individuals at unanticipated risk,” the petition said, urging the court to issue directives to the Centre to take action to restrain such unlawful collection of consumer data.
