Whose address is it anyway: the Supreme Court’s rifilis engineering ruling and a lesson in data accuracy for the dpdp era

Authored by Ammu Brigit

On 22 May 2026, the Supreme Court of India delivered a short but pointed order in M/S Rifilis Engineering Pvt. Ltd. vs. Arjun Gupta, arising out of a Special Leave Petition against a judgment of the Allahabad High Court. On its face, the case is an ordinary industrial dispute about an employee’s unauthorised absence and the employer’s attempt to serve a show-cause notice. But buried in the Court’s reasoning is a principle that resonates well beyond labour law: an entity that holds personal data cannot be faulted for acting on the information it was given, when the individual to whom that information relates failed to keep it updated.

That principle sits close to the heart of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act“), which for the first time codifies, in statutory form, the respective responsibilities of those who process personal data and those to whom it belongs. This article uses the Rifilis Engineering order as a lens to examine that allocation of responsibility, and what it may mean for organisations navigating compliance under the DPDP Act.

THE FACTS IN BRIEF

The respondent-employee had worked with the appellant-company since 2006. In May 2012, he stopped reporting to work without informing his employer. The company sent a registered notice to the address on its records, which is the permanent address the employee himself had furnished at the time of his appointment, calling upon him to explain his absence. The notice went unanswered, and the employee’s services were treated as having come to an end.

The employee subsequently claimed he had tried to rejoin duty and had been illegally kept out. He raised an industrial dispute, and after a protracted procedural history spanning an ex-parte award, a remand, and a fresh award, the Labour Court twice ruled in his favour, directing reinstatement with back wages. The Allahabad High Court upheld the second award, specifically noting that the registered notice had been sent to the employee’s permanent address in Bihar rather than to the address in Gautam Budh Nagar where he was actually residing at the time.

WHAT THE SUPREME COURT HELD

The Supreme Court set aside the High Court’s judgment and the Labour Court’s award, restoring the position in the employer’s favour. The Court refused to place the blame on the employer for sending the notice to an address that was no longer current. The Court held that the company had communicated with the only address available to it, the one the employee had himself furnished and that the burden of updating that information, if it changed, lay with the employee, not the employer. As the Court put it, an employer can only be expected to communicate with an employee at the address the employee has provided, and an individual cannot take advantage of his own omission to keep that information current.

THE DATA ACCURACY PRINCIPLE, READ THROUGH A DPDP LENS

The DPDP Act is built around the relationship between a Data Fiduciary (the entity that determines the purpose and means of processing personal data) and a Data Principal (the individual to whom the data relates). Two provisions of the Act are worth reading alongside the Supreme Court’s reasoning in this case.

Section 8(3) requires a Data Fiduciary, where personal data is likely to be used to make a decision affecting the Data Principal or is to be disclosed to another Data Fiduciary, to ensure the completeness, accuracy, and consistency of that data. This is a real and meaningful obligation, but it is not unbounded. A fiduciary’s duty is to act diligently on the data before it; It does not extend to independently discovering that a Data Principal has moved house, changed a phone number, or updated an email address without being told.

Section 12 complements this by giving the Data Principal a right to correction and updating of their personal data and places the initiating obligation on the individual. It is the Data Principal who must request the correction.

The Court effectively held that an organisation discharges its obligation when it acts reasonably on the personal data supplied to it, and that the consequences of inaccurate data where the individual has had every opportunity to correct it and has not done so cannot be visited upon the organisation.

PRACTICAL TAKEAWAYS FOR ORGANISATIONS

For HR teams, compliance officers, and Data Fiduciaries more generally, the Rifilis Engineering order offers a few practical reminders that align with good DPDP-era practice:

1. Maintain a documented record of the personal data supplied by the individual, including the date it was furnished, so that reliance on it can later be demonstrated.
2. Build in periodic prompts for individuals to confirm or update their personal data (address, contact details, emergency contacts), particularly in long-term relationships such as employment, rather than relying on a single data point captured years earlier.
3. Communicate through registered or otherwise verifiable channels to the address or contact details on record and retain proof of dispatch. This evidentiary trail proved decisive for the employer in this case.
4. Make the correction mechanism visible and easy to use. Section 12 places the onus on the Data Principal to request correction, but that obligation is only meaningful if the Data Fiduciary has told the individual how to do so.