Section 39 - Bar of jurisdiction

Section 39 gives the Data Protection Board exclusive authority over matters that the DPDPA empowers it to determine. A civil court cannot entertain a suit or proceeding seeking adjudication of such a matter, and no court or other authority may grant an injunction restraining action taken or proposed under powers conferred by the Act. The provision is intended to prevent parallel proceedings from interfering with the specialised enforcement framework established through the Board, the Appellate Tribunal and the statutory appellate process.

Commencement position: Section 39 came into force on13 November 2025. However, most substantive provisions governing complaints, inquiries, penalties and appeals are scheduled to commence on13 May 2027. The practical operation of Section 39 will therefore become substantially more important once those provisions are operational.

1.1 Matters reserved for the Board

The civil-court bar applies only where the subject matter falls within a power conferred on the Board by the DPDPA. Depending on the applicable provisions, this may include matters concerning:

• complaints by Data Principals;

• personal data breaches;

• compliance with Data Fiduciary obligations;

• Consent Manager obligations;

• processing of children’s personal data;

• Significant Data Fiduciary obligations;

• accepted voluntary undertakings;

• inquiries into alleged breaches;

• directions issued during statutory proceedings; and

• determination and imposition of monetary penalties.

A party cannot avoid the statutory procedure by filing a civil suit seeking a declaration that the Data Fiduciary complied with the DPDPA, or asking a civil court to determine whether an alleged DPDPA breach should attract regulatory action. Such questions belong within the Board’s statutory jurisdiction.

1.2 Illustration: Data Fiduciary seeks to stop an inquiry

The Board begins an inquiry into a personal data breach. The Data Fiduciary files a civil suit asking the court to declare that its security safeguards were reasonable and to restrain the Board from continuing its inquiry.

Section 39 bars the civil court from adjudicating the matter because the Board is empowered to investigate the alleged breach. The request for an injunction against the Board’s action is also expressly prohibited. The Data Fiduciary must raise its factual and legal objections before the Board and use the statutory appellate process against an appealable final order.

1.3 Independent causes of action under other laws

Section 39 should not be understood as barring every civil proceeding connected factually with personal data.

The critical question is whether the suit asks the court to determine a matter entrusted to the Board, or whether it asserts an independent legal right and seeks a remedy that the Board is not empowered to grant.

The same incident may potentially involve:

• a DPDPA complaint before the Board;

• breach of contract;

• deficiency in service under consumer law;

• negligence;

• breach of confidence;

• an employment dispute;

• an insurance dispute; or

• another independently recognised cause of action.

Section 38 provides that the DPDPA ordinarily operates in addition to other laws. Section 39 should therefore not automatically extinguish an independent claim merely because the facts also involve personal data. The court or authority would need to examine the substance of the claim, the relief sought and whether deciding it would require adjudication of a matter reserved for the Board.

1.4 Illustration: Financial loss after a banking breach

A bank suffers a personal data breach, and a customer later incurs financial loss through fraudulent transactions.

The customer may complain to the Board about the bank’s compliance with DPDPA security and breach-notification obligations. The Board may inquire into the breach and impose a monetary penalty where the statutory conditions are satisfied.

If the customer separately claims reimbursement or compensation under consumer, banking, contractual or civil law, Section 39 should not automatically bar that claim merely because the same breach forms part of the factual background. The Board does not award the Section 33 penalty to the customer, and the independent forum must determine whether it has jurisdiction over the separate cause of action and remedy.

The customer cannot, however, use the civil proceeding to ask the court to perform the Board’s regulatory function, impose a DPDPA penalty or restrain the Board’s inquiry.

1.5 No civil-court compensation under the DPDPA itself

The DPDPA does not create an express standalone right to compensation for material or non-material harm. A Data Principal cannot ordinarily overcome that omission by filing a civil suit framed only as a claim for “DPDPA compensation” and asking the civil court to exercise powers that the Act assigns to the Board.

Any monetary claim must have an independent legal foundation, such as an applicable contractual, consumer, tortious, sectoral or other legal remedy. Whether such a claim is maintainable will depend on the governing law and the relief sought.

A monetary penalty imposed by the Board remains a public regulatory sanction and is credited to the Consolidated Fund of India under Section 34. It is not compensation awarded by either the Board or the civil court to the affected Data Principal.

1.6 Prohibition on injunctions

Section 39 also prevents any court or other authority from granting an injunction against action taken or proposed under a DPDPA power.

This prevents a regulated person from using an ordinary injunction proceeding to interrupt:

• a Board inquiry;

• a statutory information request;

• a hearing;

• consideration of a voluntary undertaking;

• penalty proceedings;

• or another action lawfully pursued under the Act.

The prohibition applies to action already taken and action proposed to be taken.

It does not mean that every governmental or Board action is immune from legal scrutiny. The affected person may:

• present objections before the Board;

• challenge an appealable Board order before the Appellate Tribunal under Section 29;

• pursue further remedies available within the statutory framework; and

• invoke constitutional judicial review in an appropriate case.

1.7 Statutory appeal and judicial review

An aggrieved person cannot challenge a Board order through an ordinary civil suit. Section 29 provides the designated appellate route to the Telecom Disputes Settlement and Appellate Tribunal.

Matters such as:

• factual error;

• incorrect legal interpretation;

• procedural unfairness;

• disproportionate penalty;

• improper exercise of statutory power; or

• failure to consider relevant evidence should ordinarily be raised through that appellate mechanism.

Section 39 also should not be read as eliminating the constitutional jurisdiction of the High Courts and Supreme Court. The constitutional power of judicial review remains available in an appropriate case involving matters such as:

• lack of jurisdiction;

• violation of natural justice;

• mala fide action;

• constitutional invalidity;

• manifest arbitrariness; or

• infringement of fundamental rights.

However, constitutional proceedings should not be used routinely to bypass an effective statutory appeal merely because a party prefers a different forum. The Supreme Court’s and High Courts’ constitutional review powers occupy a different position from the jurisdiction of ordinary civil courts.

1.8 Relationship with mediation and voluntary undertakings

The existence of Section 39 does not prevent resolution through mechanisms expressly provided by the DPDPA.

A complaint may be:

• referred to mediation under Section 31; or

• addressed through a voluntary undertaking accepted under Section 32.

These mechanisms operate within the statutory framework rather than through ordinary civil-court intervention.

A private settlement may also resolve contractual or personal claims between the parties, but it cannot prevent the Board from addressing regulatory matters outside the settlement or undertaking where the Act permits further proceedings.

1.9 Data Principal seeks correction

Practical illustrations

A Data Principal asks a civil court to order a Data Fiduciary to correct personal data solely on the basis of the rights created by the DPDPA.

The court may find that the matter must first proceed through the Data Fiduciary’s grievance mechanism and, where unresolved, through the Board’s statutory process. The civil court should not exercise the Board’s DPDPA jurisdiction.

1.10 Company challenges a penalty

The Board imposes a monetary penalty on a company. The company files a civil suit seeking a declaration that the penalty is invalid and an injunction preventing recovery.

Section 39 bars that route. The company must use the appeal provided under Section 29.

1.11 Independent contractual dispute

A cloud provider discloses customer information contrary to its agreement with the Data Fiduciary. The Data Fiduciary brings a contractual claim for indemnity and damages against the provider.

Although the incident may also involve a DPDPA breach, the contractual indemnity dispute is not necessarily a matter exclusively entrusted to the Board. The civil court must examine whether the claim is genuinely based on independent contractual rights rather than an attempt to obtain a DPDPA determination.

1.12 Consumer complaint

A customer alleges that a paid digital service failed to deliver promised security protections and seeks compensation for deficiency in service.

The consumer forum would need to determine whether the claim arises independently under consumer law and whether it can decide the dispute without exercising powers reserved for the Board. Section 39 does not automatically eliminate every remedy arising under another applicable law.

1.13 Concluding interpretation

Section 39 channels DPDPA enforcement matters into the specialist statutory framework. Civil courts cannot adjudicate matters entrusted to the Board or issue injunctions interfering with action taken under the Act.

The bar is nevertheless tied to the Board’s statutory powers. It should not automatically extinguish independent contractual, consumer, employment, tortious or other legal claims merely because the underlying facts involve personal data. Such claims must have their own legal foundation and must not ask another forum to perform the Board’s regulatory functions.

Key point

Section 39 bars parallel civil adjudication of matters reserved for the Board. It does not convert the Board into a forum for every private claim arising from a data incident, eliminate the statutory appeal, or exclude constitutional judicial review in an appropriate case.

You’re right. Section 40 only requires a brief explanation of the delegated rule-making power, not illustrations or an extended breakdown.