Delhi High Court Demands Answers from Centre on Stalled Digital Personal Data Protection Act

New Delhi – The Delhi High Court has taken a critical step in addressing the prolonged delay in the implementation of India's landmark data privacy legislation, the Digital Personal Data Protection (DPDP) Act, 2023. A division bench has directed the Central Government to clarify its intentions regarding the notification of the Act, which, despite receiving Presidential assent over a year ago on August 11, 2023, remains in a state of legal limbo.

The judicial intervention stems from a writ petition filed by a working professional, Vikas Mittal, who argues that the government's inaction has created an enforcement vacuum, leaving citizens' personal data vulnerable to misuse. The case, Vikas Mittal v. Union of India , puts a spotlight on the executive's role in operationalizing parliamentary legislation and the real-world consequences of regulatory delays in the digital age.

---

The Heart of the Matter: A Law on Paper, Not in Practice

The DPDP Act, 2023, was heralded as a cornerstone of India's evolving digital framework. It aims to establish a comprehensive legal regime governing the processing of digital personal data, balancing the individual’s right to privacy with the legitimate needs of businesses and the state to process data.

Key provisions of the Act mandate that personal data can be processed only with clear consent from the individual (the "Data Principal") or for certain specified "legitimate uses." It introduces significant obligations for "Data Fiduciaries" (entities that determine the purpose and means of processing data), including implementing security safeguards, notifying users of data breaches, and honoring data principals' rights to access, correct, and erase their data.

However, the efficacy of these provisions is entirely contingent on the Act coming into force. Section 1(2) of the DPDP Act explicitly states that its provisions "shall come into force with effect from the date to be notified by the Central Government." The statute also provides flexibility, allowing the government to appoint different enforcement dates for different provisions, facilitating a phased rollout.

The petitioner’s plea highlights a critical gap: without the Act being notified, there is no legal framework to enforce these rights or obligations. The plea contends that “without implementation of the DPDP Act, businesses engage in unethical practices and compromise personal data of individuals, without proper consent.”

Judicial Scrutiny and the Mandamus Plea

During the hearing, the division bench, comprising Chief Justice D.K. Upadhyaya and Justice Tushar Rao Gedela, focused on this central issue of non-implementation. Acknowledging the petitioner's concerns, the bench issued a pointed directive to the counsel representing the Union of India.

“Let the said fact be verified by the learned counsel representing the Union of India who shall seek instructions not only in respect the fact that as to whether any notification under Sub Section (2) of Section 1 of the said Act has been issued but also as to whether any such notification is in contemplation.”

This order compels the government to move beyond ambiguity and provide a concrete status update to the court. By seeking information on whether a notification is "in contemplation," the High Court is probing the government's timeline and commitment to making the Act operational. The matter is scheduled for further hearing on November 12, when the Centre is expected to provide its response.

The petition seeks a writ of mandamus—a judicial remedy in the form of an order from a superior court to any government, subordinate court, corporation, or public authority to do some specific act which that body is obliged under law to do. In this context, it is a powerful tool to compel executive action and hold the government accountable for legislative delays.

The Broader Implications for Legal and Business Ecosystems

The delay in notifying the DPDP Act has profound implications across the legal, technological, and commercial sectors. For legal practitioners, the uncertainty complicates advisory work for clients who are attempting to prepare for compliance. Without a clear enforcement date or the final rules that will accompany the Act, businesses are left guessing about the specific technical and organizational measures they need to implement.

The establishment of the Data Protection Board of India is a critical, yet stalled, component. This adjudicatory body is envisioned as the primary authority for monitoring compliance, imposing penalties for non-compliance, directing fiduciaries in the event of a data breach, and hearing grievances from affected individuals. Until the Board is constituted, there is no specialized mechanism for redressal under the new Act, leaving data principals to rely on existing, often less effective, legal avenues.

The Act's extra-territorial scope, which applies to the processing of data outside India if it relates to offering goods or services to individuals within India, remains ineffective. This provision is crucial for regulating global technology companies that process the data of millions of Indians.

The Technological Context: AI and the Urgent Need for Data Governance

The relevance of a robust data protection law is amplified by the rapid advancements in technologies like Artificial Intelligence (AI). As highlighted in recent industry analyses, AI is transforming legal practices, from automating research and contract drafting to managing complex domains like bankruptcy and intellectual property.

For instance, specialized AI "co-pilots" are being developed to assist lawyers in highly regulated fields. These tools process vast amounts of data, including sensitive legal and personal information, to provide insights and enhance efficiency. One such example is a "patent drafting co-pilot" which can reduce drafting time by up to 90% by analyzing prior art and ensuring compliance with patent law statutes.

While these innovations promise remarkable gains, they also underscore the immense volume and sensitivity of the data being processed. The DPDP Act is designed to provide the essential "guardrails" for such data-intensive operations. Its principles of purpose limitation, data minimization, and accountability are fundamental to ensuring that AI development and deployment occur responsibly. The current regulatory vacuum means that the legal framework is lagging significantly behind the technological curve, creating risks for both businesses and individuals.

Conclusion: Awaiting Clarity

The Delhi High Court's intervention marks a pivotal moment for data privacy in India. The government's response on November 12 will be closely watched by the entire legal and business community. A definitive timeline for the Act's implementation will end the prevailing uncertainty and kickstart the final phase of compliance preparations. Conversely, a continued lack of clarity will only prolong the risks associated with an unregulated digital data ecosystem.

This case serves as a crucial reminder that the legislative process does not end with a President's assent; it is the executive's duty to breathe life into a statute through timely notification and implementation. For millions of Indian citizens and thousands of businesses, the promise of a secure and rights-respecting digital future hinges on this next, long-awaited step.