The Kerala High Court has told the Union government to make India's Data Protection Board functional within eight weeks. According to The Hindu, the court said the privacy of citizens is being compromised, and the concerns it considered include how passengers' data is handled at airports. The Kerala High Court Data Protection Board order puts a deadline on a body that the Digital Personal Data Protection (DPDP) Act, 2023 relies on for enforcement.

The available reporting is brief, so this post sticks to what has been confirmed and explains why it matters.

What the Kerala High Court ordered

The court directed the Centre to activate the Data Protection Board within eight weeks. The direction came amid privacy concerns over passengers' data at airports, and the court observed that citizens' privacy is being compromised.

The order does not create a new law or new obligations. It asks the government to put in place the institution that the existing law already describes. That distinction matters: the legal framework exists, but the court is signalling that a framework without a working enforcement body does not protect anyone in practice.

Why the Data Protection Board matters for the DPDP Act

The DPDP Act 2023 sets out rules for how organisations handle personal data. Rules on paper only count if someone can examine complaints, assess violations, and act on them. The Data Protection Board is meant to be that body.

Until it is functional, people who believe their data has been misused have no fully operating regulator to take that complaint to. Organisations, in turn, face little practical pressure to change how they collect and store information. This is the core of the enforcement gap the court's order points to: a law can be enacted and still remain largely unenforceable.

The eight-week window is a concrete test. Readers can watch whether the Board is actually made operational by the deadline, and what powers and staffing it has once it is.

How airport passenger data collection puts travelers at risk

Airports are a pressure point for personal data. Travelers hand over identity documents, travel itineraries, and in some systems biometric information as part of routine processing. The concern in this case centres on passengers' data at airports, and it is easy to see why: people have little choice about providing it, and they rarely know where it is stored, who can access it, or how long it is kept.

Large, centralised collections of this kind are attractive targets and are only as safe as the controls around them. Without a regulator able to investigate complaints or examine practices, travelers have limited recourse if something goes wrong. Recent incidents elsewhere show what exposure looks like. France's ANTS passport portal breach involved the agency behind the country's secure identity documents, and the Lithuania state registry breach affected records held by the state itself.

How India's enforcement gap compares with other privacy regimes

Many privacy regimes pair legal rights with an authority that can receive complaints and impose consequences. The difference in India's case, as the court's order highlights, is that the law has been passed while the body meant to enforce it is not yet working. We have not seen details in the source reporting about how the Board will be structured, so comparisons should be made cautiously.

What can be said is that strong text alone does not prevent exposure. Government-held databases have been compromised in other countries. The Mexico data breach that exposed 195 million identities and the 10 million records leaked from Chile's Civil Registry show what can happen when citizen data is held at scale and poorly protected.

What This Means For You

If you travel through Indian airports, the order does not change what is collected from you today. What it does is increase pressure for a working regulator that could eventually examine those practices and hear complaints.

For travelers and residents more broadly, the practical point is that you cannot rely on a regulator to safeguard data that is already collected. A VPN does not help with data you hand over at a check-in counter or border desk, so the focus should be on limiting what you share and securing your own accounts.

Actionable takeaways

  • Share only the personal information that is required, and ask what is collected and why when you can.
  • Keep copies of your travel and identity documents secured, and avoid sending them over unencrypted channels.
  • Use unique passwords and multi-factor authentication on airline, booking, and government service accounts.
  • Watch for notices of data breaches affecting services you use, and change credentials promptly if you are affected.
  • Follow whether the Data Protection Board is operational once the eight-week deadline passes.

The Kerala High Court Data Protection Board order is a reminder that rights on paper need an institution behind them. Weak enforcement combined with large government-held databases leads to real exposure, as the Mexico and Chile breaches show. Until India's Board is working, treat your data with care and share it sparingly.