Bar of Civil Court Jurisdiction

Meaning of Bar of Civil Court Jurisdiction

No civil court can entertain a suit or proceeding on a matter the Board is empowered to decide under the Act, or grant an injunction in respect of action taken under it. Complaints go to the Board, with appeals to the Appellate Tribunal.

Section 39 contains two linked bars. First, no civil court has jurisdiction to entertain any suit or proceeding about a matter the Board is empowered to decide under the Act. Second, no court or other authority may grant an injunction in respect of any action taken, or to be taken, under a power given by the Act. The first closes the front door to the civil courts; the second prevents an interim order from freezing the Board's work while a dispute is argued somewhere else.

Parliament uses this sort of clause in many regulatory statutes, because it wants specialist bodies to build up expertise and to decide quickly. Under the DPDP Act, the specialist body is the Data Protection Board of India. Its powers sit in Sections 27 and 28: receiving complaints and intimations of breach, conducting inquiries, giving directions and, after an inquiry, imposing monetary penalties under Section 33. Its proceedings are meant to run digitally as a "digital office", and a person aggrieved by a Board decision appeals to the Appellate Tribunal under Section 29, within 60 days.

The bar has limits. It applies to matters the Board is empowered to decide, not to every dispute that happens to involve personal data. A contract dispute between two companies about who owns a database, a defamation suit over a leaked document, a criminal prosecution under the IT Act or the Bharatiya Nyaya Sanhita, or a service dispute in an employment contract are different causes of action. Whether a particular claim is barred depends on whether the Act gives the Board power over it, and that is a question for lawyers on the actual pleadings.

It is also worth being clear about what Section 39 does not say. It speaks of civil courts and of injunctions. It does not purport to take away the constitutional jurisdiction of the High Courts and the Supreme Court to review State action, which an ordinary Act cannot remove. It also does not make the Board a compensation court: the Act's Schedule speaks of monetary penalties payable after an inquiry, so a person who wants damages for loss should take advice about what other remedies remain available.

Examples of Bar of Civil Court Jurisdiction

Why Bar of Civil Court Jurisdiction matters

For a Data Fiduciary, Section 39 shapes litigation strategy. A company that receives a Board inquiry notice cannot walk into a civil court and ask for a stay on the proceeding. It has to respond before the Board, present its evidence and arguments there, and, if it loses, use the Section 29 appeal. Missing the 60-day appeal window because the team spent weeks drafting a civil suit that was never maintainable is an avoidable and expensive error, especially when penalties run up to ₹250 crore for security failures and ₹200 crore for failing to notify a breach.

For a Data Principal, the clause points to a clearer, cheaper path. Instead of paying for a civil suit that may be thrown out at the threshold, you first raise a grievance with the fiduciary, and if it is not resolved you complain to the Board, which can inquire and penalise. That channel is designed to be accessible and online, though it will not necessarily deliver individual compensation.

How it works in practice

1. 1Map the dispute to its forum before spending money. List the claims in a dispute, and mark which ones are matters the Board can decide (for example, a failure to honour a Section 11 or 12 request, or a security breach) and which are separate causes of action such as contract or defamation.
2. 2If you are a Data Principal, start with the fiduciary's grievance channel under Section 8(10) and Section 13, keep copies of every message, and file the complaint with the Board only after the fiduciary's own timeline has lapsed or its answer is unsatisfactory.
3. 3If you are a Data Fiduciary served with a Board notice, appoint a single response owner, preserve all relevant logs and records, and file your reply within the time the notice gives. Do not rely on court interim relief to stop the inquiry, because Section 39 bars injunctions of that kind.
4. 4Diary the appeal deadline the day an adverse order arrives. Section 29 allows 60 days to approach the Appellate Tribunal, and counsel needs time to read the order, prepare grounds and calculate the fee prescribed in the Rules.
5. 5Keep criminal, regulatory and civil tracks separate. A data incident can lead to a Board inquiry, a CERT-In report, a police complaint and a contractual claim by a client. Section 39 affects only the first, so your plan should address each forum on its own terms.

Where it appears in the DPDP Act and Rules

Common mistakes to avoid

Compliance tips

• Put the Board inquiry and appeal steps into your incident response plan, with named contacts and a calendar of statutory deadlines.

• Tell Data Principals in your grievance policy that unresolved complaints can go to the Board, so they do not lose time in the wrong forum.

• When you brief outside counsel, give them Sections 27, 28, 29, 33 and 39 together, so the advice treats forum and procedure as one question.

• Keep your pleadings and replies consistent across forums. A statement made in a CERT-In report or police complaint can be read by the Board later.

Common questions about Bar of Civil Court Jurisdiction

Related terms

More in Laws, enforcement & penalties

Keep learning