Delhi High Court to Hear PIL Challenging Digital Personal Data Protection Act - 2026-02-21

New Delhi — A Public Interest Litigation filed in the Delhi High Court seeks to strike down or sharply read down several provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. The petition argues that the framework creates an executive-dominated architecture that undermines judicial independence, constitutional rights, and the basic structure of governance.

What the petition contends - The petitioner, Dr. Chandresh Jain, alleges that key sections of the DPDP Act (including 17 to 21, 23, 29, 33, 34, 36, 37, 39, 40 and 44, along with the Schedule) and the corresponding rules grant unfettered executive power to access and control personal data. The complaint emphasizes that this power is dangerously opaque and lacks adequate safeguards. - It is argued that the Data Protection Board (DPB) and the appellate body (the Telecom Disputes Settlement and Appellate Tribunal, or its analogue) operate under Executive control, compromising independence and eroding judicial review. The petition highlights that Section 39 bars civil court jurisdiction, a provision seen as incompatible with constitutional guarantees of due process and checks and balances. - The design allegedly centralizes discretionary power in the hands of the Executive, enabling broad exemptions for government actors, opaque exemptions, and the possibility of data processing and surveillance without robust accountability. - The petition asserts that the DPDP Act’s architecture conflicts with the constitutional guarantees of equality, privacy, informational autonomy, free expression, and procedural fairness, and that it undermines the basic structure that includes judicial independence and separation of powers. - Journalistic and public-interest activities are singled out for potential chilling effects, with calls to preserve journalistic sources, reporting, and the broader freedom of the press from intrusive data regimes.

Timeline and context cited in the petition - The DPDP Act was enacted to protect personal data but is criticized for granting excessive state power, broad data access, and insufficient oversight. - The DPDP Rules were notified on a date referenced as 2025, establishing the Data Protection Board as part of the regime. - A notable milestone cited in the petition is the notification of the DPDP Rules on a date in 2025, which reportedly brought the Data Protection Board into force and formalized the structure of data governance. - The petition frames the DPDP regime as a potential threat not only to privacy but to democratic governance, rule of law, and the right to information.

Grounds for relief being sought - Declaring multiple sections of the DPDP Act and DPDP Rules, and the Schedule, as unconstitutional or ultra vires and void for violating fundamental rights, including Articles 14, 19(1)(a) and 21, and for undermining the Basic Structure of the Constitution. - Severing or reading down provisions that vest unaccountable executive power or that channel appeals away from independent judicial oversight. - Reading down or striking down provisions that enable blocking, data access, or compelled disclosure without due process or independent scrutiny. - Ensuring that RTI protections and journalism-related rights are preserved, with exemptions for journalistic activities from prior restraints or punitive penalties. - Preserving the independence of adjudicatory bodies and preventing the overreach of executive rule-making powers in the DPDP regime.

Dates and procedural notes - The petition is framed as a Writ Petition under Article 226 of the Constitution, filed in the relevant court with the aim of enforcing fundamental rights and addressing potential legislative overreach affecting public interest. - The petition points to a sequence of legal developments and judgments about tribunals, judicial independence, and the balance of power as guiding principles for evaluating the DPDP framework. - It also documents the public-interest stakes of a data regime affecting more than 1.4 billion people, highlighting concerns about dignity, autonomy, and digital rights.

What to watch for next - The Delhi High Court is expected to hear arguments on whether the impugned provisions can be severed, read down, or declared unconstitutional, and how the DPB and any appellate mechanisms should be structured to align with constitutional guarantees. - The court’s rulings could have implications for the ongoing implementation of the DPDP Act and Rules, including how privacy protections, transparency, and press freedoms are safeguarded in practice. - The case may influence future discussions on how data protection regimes balance state interests, individual rights, and the integrity of judicial oversight in a rapidly digitizing society.