PhonePe vs. State: Karnataka HC to Rule on Police Access to UPI User Data

Bengaluru, India – The Karnataka High Court has initiated proceedings in a pivotal case that could redefine the boundaries between citizen privacy, the obligations of digital payment intermediaries, and the investigative powers of law enforcement in India's burgeoning digital economy. A division bench, comprising Chief Justice Vibhu Bakhru and Justice C M Poonacha, has issued a notice to the State of Karnataka on an appeal filed by digital payments giant PhonePe. The appeal challenges a single-judge order that upheld the police's authority to demand sensitive user and transaction data under the Code of Criminal Procedure (CrPC).

The case, which scrutinizes the delicate balance between fighting cybercrime and protecting personal data, has been slated for a further hearing on February 12, 2026. Its outcome is poised to set a crucial precedent for the entire fintech sector and its millions of users.

The Genesis of the Dispute: A Section 91 Notice

The legal battle stems from a notice issued by the police to PhonePe under Section 91 of the CrPC. This provision empowers a court or a police officer in charge of a station to compel the production of any "document or other thing" deemed necessary for an investigation. In this instance, the police sought comprehensive transaction details and account credentials of certain registered users and merchants as part of a criminal probe.

PhonePe contested this notice, arguing that as a Unified Payments Interface (UPI) intermediary, it is subject to specific statutory protections that supersede the general powers granted by the CrPC. The company took the matter to the High Court, seeking to quash the police notice, thereby igniting a significant legal debate on the procedural safeguards available to financial intermediaries in the digital age.

The Single Judge's Stance: Public Interest Over Data Protection

On April 29, a single judge of the Karnataka High Court dismissed PhonePe’s petition, delivering a robust verdict in favour of law enforcement's investigative needs. The court's ruling was anchored in the principle that individual data protection duties must give way to broader societal concerns. The order emphatically stated, “The duty to protect data must yield, where public interest and criminal investigation intersect."

The single judge highlighted the evolving nature of crime, emphasizing that as "conventional crimes have receded and new age cyber crimes have sprung in large numbers, swift, targeted and effective response is need of the hour." This reasoning suggests a judicial inclination to empower police with the necessary tools to navigate the complexities of digital evidence.

Rejecting PhonePe's arguments, the court found that the police, as a statutory authority under the CrPC, are well within their rights to seek such information. The judgment reasoned that privacy, while a fundamental concern, “cannot be wielded as a shield against lawful investigation.” This assertion places the case squarely at the centre of the ongoing global dialogue about the limits of personal privacy in the face of state security and law enforcement objectives.

The Appeal: Invoking the Bankers Book Evidence Act

In its appeal before the division bench, PhonePe, represented by Advocate Nitin Ramesh, has advanced a nuanced legal argument centred on the Bankers Book Evidence Act, 1891. Ramesh contended that this century-old legislation provides a specialized framework that governs how financial information can be accessed, creating an exception to the sweeping powers of Section 91 of the CrPC.

According to PhonePe's submission, the 1891 Act establishes a "layer of protection" for UPI intermediaries, which, it argues, function akin to banks in the digital ecosystem. The core of this argument is that law enforcement cannot unilaterally demand such sensitive data. Instead, "The only manner in which such information can be sought for by the investigator is by taking permission of the court.”

This position suggests that while PhonePe does not claim absolute immunity from disclosure, it insists on a process involving judicial oversight, which would serve as a crucial check against potential overreach or misuse of investigative powers. The company argued that the single judge failed to appreciate this critical layer of statutory protection.

Reconciling Old Laws with New Technology

A significant portion of the single judge's original order was dedicated to interpreting the Bankers Book Evidence Act in the context of a Section 91 notice. The court had rejected PhonePe's contention by examining the definition of "legal proceeding" under Section 2(4) of the 1891 Act. This section defines it as any inquiry where evidence may be required or "in which any investigation or inquiry under the CrPC is contemplated."

Based on this, the single judge concluded that a police investigation under the CrPC falls within the ambit of a "legal proceeding" as defined by the Act. Therefore, the court held that “notice under Section 91 of the Cr.P.C, in pursuance to an investigation or inquiry can be construed to be a notice under Section 2(4) of the 1891 Act.” This interpretation effectively merges the procedural requirements, allowing a Section 91 notice to serve the function of a court-sanctioned request under the Bankers Book Evidence Act, a conclusion that PhonePe is now vigorously challenging.

Broader Implications for the Digital Ecosystem

The final verdict from the division bench will have far-reaching consequences for India's digital economy.

• Clarity for Fintech Intermediaries: The case will provide much-needed legal clarity on the precise obligations of UPI platforms, digital wallets, and other fintech companies when faced with data requests from law enforcement. It will determine whether they can demand a court order or must comply directly with police notices under Section 91 CrPC.

• User Privacy and Trust: For millions of users who rely on digital payments, this case touches upon the core of their data privacy. A ruling in favour of the state could be perceived as weakening privacy protections, potentially impacting user trust in digital platforms. Conversely, a ruling favouring PhonePe’s stance would reinforce the principle of judicial oversight in accessing sensitive financial data.

• The Future of Cybercrime Investigation: Law enforcement agencies argue that seamless and swift access to digital transaction data is indispensable for tackling modern financial fraud, online betting rings (as alleged by the prosecution in this matter), and other cybercrimes. A decision that imposes additional procedural hurdles, such as mandatory court orders, could be seen as a hindrance to timely and effective investigations.

• Legislative Scrutiny: The case highlights the potential gaps and ambiguities that arise when archaic laws like the Bankers Book Evidence Act, 1891, are applied to 21st-century technology. The outcome may prompt legislative action to create a more explicit and modern legal framework governing data access for digital financial intermediaries, aligning with the principles laid out in the new Digital Personal Data Protection Act.

As the matter now rests with the division bench, the legal and tech communities will be watching closely. The Karnataka High Court is tasked with harmonizing the imperatives of criminal justice with the fundamental right to privacy in an era where the digital footprint is an extension of the self. The court's decision will not only resolve the dispute between PhonePe and the State of Karnataka but will also draw a critical line in the sand for data governance in India's digital future.