At a Glance
Bench
3 judges on the bench
Chief Justice Surya Kant
Presiding Judge · Bench lead
Justice Joymalya Bagchi
Judge · Bench member
Justice V.M. Pancholi
Judge · Bench member
Who Filed the Case
5 tracked petitioners
Venkatesh Nayak
Petitioner
National Campaign for People’s Right to Information
Petitioner
The Reporters’ Collective Trust
Petitioner
Geeta Seshu
Petitioner
Anjali Bhardwaj
Petitioner
Respondent
UNION OF INDIA
Present Update
Current procedural snapshot
Notice issued; no interim stay
On 16 February 2026, the Bench heard the matter, issued notice to parties, and refused interim stay on the DPDP Act.
Last hearing
23rd March 2026
Next hearing
13th May 2026
Live Updates Thread
This section is designed like a timeline. Keep the newest update at the top of the list in Framer.
Notice issued; interim stay declined
The Bench of Chief Justice Surya Kant, Justice Joymalya Bagchi, and Justice V.M. Pancholi heard the matter, issued notice to parties, and declined to stay the DPDP Act at this stage.
Article 32 challenge filed
A writ petition challenged Sections 17(1)(c), 17(2), 33(1), 36 and 44(3) of the DPDP Act, 2023 and Rules 17 and 23(2) of the DPDP Rules, 2025, alleging violations of Articles 14, 19(1)(a) and 21.
Judgment / Order Table
Recent orders and judgments, with view access for uploaded source documents.
Case Number Table
Connected petitions and case records currently being tracked on this page.
Brief of the Case
The evolution of the Digital Personal Data Protection (DPDP) Act, 2023 is a landmark journey in Indian jurisprudence, transitioning from a fundamental right declaration to a comprehensive statutory framework. The DPDP law is said to be effective from 13 November 2025, across the landscape of India and to those service the residents of India. The Law had provided an eighteen month implementation lifecycle, with the Consent component of the Law being effective by 13 November 2026. A brief summary of the journey upto 13 November 2025 since the initiation of the enactment process is as follows: -
Counsel
Petitioners: Indira Jaising, Mishi Choudhary, Paras Nath Singh, Prasanth Sugathan, Jayant Malik, Kabir Darshan Singh, Syed Mohammad Haroon, Sadeeq Ur Rahman, Abhishek Manu Singhvi, Muhammad Ali Khan, Omar Gupta, Eesha Bakshi, Uday Bhatia, Naman Basoya, Abishek Jebaraj, A. Reyna Shruti & others
Respondent: Tushar Mehta, Gurmeet Singh Makker, Madhav Sinhal, Rajat Nair, Shilpa Ohri, Mayank Pandey, Chander Uday Singh, Cheryl D’souza, Bidya Mohanty, Katyayani Suhrud, Abhishek K., Anushka Singh & others
How the Law Reached This Point
The Genesis: Justice K.S. Puttaswamy vs. Union of India (2017)
The Supreme Court declared privacy a fundamental right under Articles 14, 19 and 21, and laid the foundation for a robust data protection regime.
The Srikrishna Committee (2018)
The committee released a white paper, conducted public consultation, and submitted the first draft of the Personal Data Protection Bill, 2018.
Legislative Iterations (2019–2021)
The draft evolved through the PDP Bill 2019, Joint Parliamentary Committee review, and eventual withdrawal of the bill in 2022 for a broader legal reset.
The DPDP Act, 2023: Finalization and Enactment
A leaner digital-first bill returned, was passed by both Houses of Parliament, and received Presidential assent on 11 August 2023.
Current Status: Rules and Enforcement (2025–2026)
The DPDP framework moved into the rules-and-enforcement phase, with operational questions, deadlines, and the structure of the Data Protection Board becoming central.
On 2 February 2026, Shri Venkatesh Nayak, an RTI activist filed a writ petition under Article 32 of the Constitution, challenging Sections 17(1)(c), 17(2), 33(1), 36 and 44(3) of the DPDP Act 2023 and Rules 17 and 23(2) of the Digital Personal Data Protection Rules, 2025 (DPDP Rules). The petition argues that the provisions violate Article 14, 19(1)(a) and 21 of the Constitution.
Shri Nitin Sethi and The Reporters Collective also filed a separate petition against certain provisions of the DPDP Law on certain other violations. The petitioner claimed that, Section 44(3) of the DPDP Act amended Section 8(1)(j) of the Right to Information Act, 2005 which exempts the disclosure of any information “which relates to personal information”. The petitioners claim that this amendment creates a “blanket ban on the obligation to disclose personal information”. This will allow the executive to deny information to citizens by citing the “personal nature of the information”. Petitioners argue that this will violate the right to information and the right to know, which is provided under Article 19(1)(a)—the fundamental right to speech and expression.
The Petitioners have also challenged Section 17(1)(c), which allows the processing of data in the “interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India”. Section 17(2) states that the Act will not be applicable when data is processed by the Union government, or any authority it may notify, in the “interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these”. The petitioners are apprehensive that the provisions will result in a “surveillance regime”, with no safeguards or review mechanism. The petitioner claims here that quoted provisions are arbitrary and violates Article 14.
The petitioners argue that Section 36 creates a "black box" for government surveillance by requiring entities to provide any data the Union Government requests. They contend this lack of "statutory guidance" gives the state unfettered power. Furthermore, Rule 23(2) acts as a "gag order," preventing companies from informing users that their personal data has been handed over if the government claims it involves "national security" or "sovereignty".
The petitioners have also cited Lack of Judicial Independence in the implementation of the DPDP Law. Thee formation of the Data Protection Board of India (DPBI) under Section 18 is under fire for violating the Separation of Powers. Critics point out that Rules 17(1) and 17(2) allow the Executive branch to dominate the committee that selects the Board's Chairperson and members. This "executive dominance" raises fears that the Board will not be an impartial adjudicator when the government itself is the Data Fiduciary.
While Section 33(1) prescribes heavy financial penalties for "significant" data breaches, the petitioners have held up an argue that the law fails to define what "significant" actually means. Without clear statutory criteria or guidance, they claim the provision is dangerously vague, leaving businesses in a state of legal uncertainty regarding when a breach triggers the maximum penalty.
On 16 February 2026, the Bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V.M. Pancholi heard the matter and issued notice to parties. The Bench refused to grant an interim stay on the DPDP Act. Further, the Court may referred the matter to a larger bench being a Constitutional matter and entails Judicial Review of a Law enacted by the Parliament of India.
As of March 2026, at least five writ petitions challenging key provisions of the DPDP Act and DPDP Rules 2025 are being heard by a bench led by Chief Justice of India Surya Kant. This Page of DPO CLUB, endeavours to track the ensuing case.
Salient Issues in the Case
These are the major legal questions highlighted in the brief and challenge materials.
Independence of the Data Protection Board (DPBI)
The challenge questions executive dominance over the selection and functioning of the Board, and whether that undermines separation of powers when the State itself is a major data fiduciary.
State Surveillance and Gag Orders
The petitions challenge broad state access powers, especially Section 36 and Rule 23(2), arguing that they enable opaque data disclosures without clear statutory guidance or transparency safeguards.
Vague Definitions of Significant Breaches
Section 33(1) is challenged for penalizing significant breaches without clearly defining what makes a breach significant, creating legal uncertainty for organizations.
Amendment to Section 8(1)(j) of the RTI Act
The challenge argues the amendment removes the public interest balancing test and creates a wider shield around personal information linked to public functionaries.
Articles 14, 19(1)(a) and 21
The petitions frame the matter as one involving equality, free speech, the right to know, privacy, and constitutional accountability.