The Delhi High Court on Wednesday pressed the Union government to explain why the landmark Digital Personal Data Protection (DPDP) Act, 2023, has not yet been enforced, despite receiving presidential assent over a year ago.
The bench of Chief Justice D.K. Upadhyay and Justice Tushar Rao Gedela was hearing a plea by Vikas Mittal, who alleged that weak safeguards had allowed companies to collect and exploit personal data without consent.
India to Honour Top CISOs from Police, Law Enforcement, and Defence Forces
Petitioner Flags Rampant Data Misuse
Mittal accused e-commerce platform GoKwik of harvesting consumer data through cookies and sharing it with online retailers, including eyewear giant Lenskart. He argued that the absence of enforceable protections exposes millions of Indians to profiling and misuse of sensitive information.
The petition underscored how citizens remain unprotected while businesses continue to build data-driven models unchecked. “Unregulated misuse of data endangers public confidence in digital services,” Mittal said in his plea.
Government Still Finalizing Rules
The DPDP Act, passed in August 2023, aims to regulate how personal data is collected, stored, and processed, while also establishing a Data Protection Board of India. Penalties under the Act can run into hundreds of crores for violations.
However, the Centre has yet to notify the law, citing ongoing consultations on draft DPDP Rules, 2025. Parliament was informed in July that the draft drew nearly 7,000 responses from businesses and civil society, which are under review.
High Court Seeks Clarity by November 4
The court observed that it cannot issue binding orders until the law is operationalized. “As of today, the Act has not come into force. How can we pass an order?” the bench noted, directing the Centre to clarify its position by November 4.
The case highlights mounting concerns over India’s delay in enforcing privacy protections, even as its digital economy expands rapidly. Whether the Centre moves swiftly to implement the DPDP Act could determine public trust in the government’s ability to safeguard data in the world’s fastest-growing online marketplace.