Delhi High Court raises questions to Centre on implementation of DPDP Act

The Delhi High Court has asked the Central Government about implementation of the Digital Personal Data Protection (DPDP) Act, 2023. The legislation paves the way for processing digital personal data in a manner that protects both— individuals' right to privacy and the need to process their personal data for lawful purposes. However, even after receiving Presidential assent on August 11, 2023, the Act is yet to be notified.

The Petitioner, who is a working professional, has invoked the High Court's writ jurisdiction seeking a mandamus directing the Centre to notify the Act. The plea claims that without implementation of the DPDP Act, businesses engage in unethical practices and compromise personal data of individuals, without proper consent.

According to the DPDP Act, personal data can be processed only after taking the consent and for certain “legitimate uses”. “Personal data” is defined under the Bill as “any data about an individual who is identifiable by or in relation to such data.”

It is to be noted that as per Section 1(2) of the Act, it shall come into force with effect from the date to be notified by the Central Government. It further provides that different dates may be appointed for different provisions of this Act to come into force.

The Court was however informed that no such notification has been issued yet. As such, a division bench comprising Chief Justice DK Upadhyaya and Justice Tushar Rao Gedela directed –

“Let the said fact be verified by the learned counsel representing the Union of India who shall seek instructions not only in respect the fact that as to whether any notification under Sub Section (2) of Section 1 of the said Act has been issued but also as to whether any such notification is in contemplation.”

The matter is now listed on November 12.