Delhi High Court seeks Centre's response on PIL against Digital Personal Data Protection Act

The Delhi High Court on Wednesday issued notice to the Central government on a public interest litigation (PIL) petition challenging the constitutionality of key provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 [Chandresh Jain Vs Union of India and Ors.].

The Division Bench of Chief Justice Devendra Kumar Upadhyaya and Justice Tejas Karia directed the Ministry of Law & Justice, the Ministry of Electronics and Information Technology (MEITY) and the Department of Personnel and Training (DoPT) to file their replies.

The PIL has been filed by advocate Chandresh Jain challenging Sections 17,18,19,20, 21, 23, 29, 33, 34, 36, 37 and 44 of the DPDP Act, 2023 read with Rules 17-23 of the DPDP Rules, 2025. He has also challenged the schedule to the Act, which prescribes penalties for violation of the Act's provisions.

According to Jain, these provisions go against citizens' rights under Articles 14, 19, and 21 of the Constitution.

As per the petition, Section 17 allows broad government exemptions from core data protection obligations. Sections 18 to 21 establish the Data Protection Board and define its powers and functioning. The petitioner argues that the board is entirely controlled by the government.

Sections 23 and 29 provide the appellate framework to TDSAT, and then to the Supreme Court of India, escaping any "appellate or supervisory jurisdiction of the High Courts".

Further, Sections 33 and 34 provide for heavy financial penalties, Section 36 empowers the government to call for information, and Section 37 allows blocking non-compliant platforms. Section 39 bars civil court jurisdiction, and Section 40 grants the government wide rule-making powers. Meanwhile, Section 44 amends the RTI Act. It is Jain's case that the amendment restricts citizens' right to information of public interest.

As per the petition, that these provisions of the DPDP "create a statutory architecture that is fundamentally inconsistent with human rights, rule of law, and judicial independence".

"The DPDP Act creates a closed loop of executive power, where the first adjudicator (Data Protection Board) and the appellate authority (TDSAT) both remain under executive control, while Section 39 expressly bars the jurisdiction of civil courts. This structure is constitutionally unsustainable and violates the human rights requirement of an independent adjudicatory body, as recognised in Puttaswamy and the MBA Trilogy, and as mandated under Articles 14, 21, and 50," the plea states.