Courts Refuse to Wait for MeitY: How the Judiciary is Force-Feeding the DPDP Act to India Inc.

For the last three years, the standard advice from Indian technology and privacy lawyers to their corporate clients regarding the Digital Personal Data Protection (DPDP) Act, 2023 has been a cautious, "Wait and watch." With the Ministry of Electronics and Information Technology (MeitY) dragging its feet on a phased rollout—and substantive obligations like cross-border transfers reportedly delayed until May 2027—a dangerous complacency has set in. But if the latest developments from the Supreme Court and the Kerala High Court prove anything, it is this: the judiciary has lost patience with the regulatory vacuum.

The courts are no longer waiting for the Executive to operationalize the DPDP Act. They are actively enforcing its principles through judicial fiat, fundamentally altering how practitioners must advise clients on data compliance right now.

The Phantom Board Meets Judicial Mandamus

The most striking intervention comes from the Kerala High Court, which recently heard a Public Interest Litigation (PIL) challenging the privacy implications of the Digi Yatra facial recognition system at airports. The Court didn’t just issue notices; it directly targeted the institutional paralysis at the heart of the DPDP regime.

Noting that passenger data processing is strictly subject to the DPDP Act and the newly minted Digital Personal Data Protection Rules, 2025, the High Court ordered that the Data Protection Board of India (DPB)—the designated adjudicatory body under Section 18 of the Act—be made fully functional within eight weeks.

"This is a massive wake-up call for the government and data fiduciaries alike. You can no longer hide behind the excuse that the adjudicatory machinery does not exist. The High Court has essentially issued a mandamus to breathe life into Section 18."

For practitioners, this changes the litigation landscape immediately. If the DPB is forced into existence by judicial timeline, the window for companies to transition their consent architectures is violently compressed. You cannot advise your airport, hospitality, or travel-tech clients that they have until 2027 to comply. The enforcement mechanism is being built in real-time under court supervision.

APAAR and the Myth of Administrative Immunity

Simultaneously, the Supreme Court has dismantled the assumption that government-run administrative schemes can skirt strict DPDP compliance. While reviewing the Automated Permanent Academic Account Registry (APAAR), the apex court issued binding directions on how student data must be handled.

The Court mandated that the APAAR consent form must include a clear opt-out/refusal option, and explicitly restricted the sharing of student data with private entities or third parties unless expressly authorized by law. More importantly, the bench clarified that data collected under administrative schemes remains fully subject to the DPDP Act.

Why does this matter for your practice? Because it sets a stringent judicial standard for Section 6 (Consent) before the Consent Managers under the 2025 Rules even become operational (expected November 2026). The Supreme Court has signaled that "bundled" or "forced" consent in state services will not survive judicial scrutiny. If you represent EdTech platforms or private entities hoping to tap into the APAAR database via API integrations, your data-sharing agreements need immediate redrafting. The data fiduciary (the State) cannot pass on this data without explicit, granular consent, severing the pipeline of "assumed" data flows.

The RTI Conflict: Section 44(3) is a Loaded Gun

While the courts are enforcing privacy on one end, they are grappling with its weaponization by the State on the other. The Supreme Court has referred the constitutional challenge against Section 44(3) of the DPDP Act to a larger Constitution Bench.

Section 44(3) stealthily amended Section 8(1)(j) of the Right to Information (RTI) Act, 2005. Previously, personal information could be disclosed under the RTI Act if a larger public interest justified it. The DPDP amendment obliterated that public interest test, creating a blanket exemption for all personal information.

The Supreme Court recognized this as a constitutionally sensitive issue, effectively pitting the fundamental right to privacy against the fundamental right to information. However, crucially for litigators, the Court did not stay the amendment pending adjudication.

This means Section 44(3) is currently operative. State departments are already weaponizing this amendment to reject RTI applications en masse, citing the DPDP Act. If you are a litigator relying on RTI responses to build writ petitions or civil suits (especially in service matters, tenders, or corruption cases), your primary fact-finding tool has been severely blunted. You must now creatively argue what constitutes "personal data" versus "public data," a distinction the Supreme Court itself noted as the crux of the upcoming Constitution Bench hearing.

What This Means for Your Practice

We are witnessing a fascinating, albeit chaotic, phase of Indian technology law. The executive wants a staged, industry-friendly rollout stretching into 2027. The judiciary, faced with immediate constitutional questions on privacy, is enforcing the law now.

Here is the actionable intelligence for law firms:

1. Stop waiting for Rule 15: Cross-border transfer rules aren't technically live, but as Bar & Bench recently highlighted, smart firms are already redrafting vendor contracts. Why? Because courts are treating the overarching principles of the DPDP Act as active law. Draft your Standard Contractual Clauses (SCCs) now.
2. Audit Consent Forms Today: The SC’s APAAR ruling means your clients’ consent forms must have an unambiguous opt-out mechanism immediately. "Take it or leave it" privacy policies are dead on arrival.
3. Prepare for the DPB: With the Kerala HC forcing the Board's constitution within eight weeks, the era of zero regulatory enforcement is ending. Ensure your clients have their Data Protection Officers (DPOs) appointed and their breach notification protocols (Section 8) ready to deploy.

The DPDP Act is no longer a theoretical compliance exercise for the future. Through public interest litigation and constitutional challenges, the judiciary has dragged the Act into the present. Lawyers who continue to advise their clients to wait for MeitY's official Stage 3 commencement are walking them straight into regulatory crosshairs.