Section 39 of Digital Personal Data Protection Act, 2023 - Bar of Jurisdiction
Section 39 limits the jurisdiction of civil courts in matters that the Data Protection Board of India is empowered to deal with under the Digital Personal Data Protection Act, 2023 (Act 22 of 2023). It also restricts courts and other authorities from granting injunctions against action taken, or proposed to be taken, under powers conferred by the Act.
Text and meaning of Section 39
No civil court shall have jurisdiction to entertain a suit or proceeding concerning a matter for which the Board is empowered under the Act. The section further provides that no court or other authority may grant an injunction concerning action taken, or proposed to be taken, in exercise of a power under the Act.
In practical terms, the first limb of Section 39 is a statutory bar directed specifically at civil court jurisdiction where the subject matter falls within powers assigned to the Board by the Act. The second limb separately prevents the grant of an injunction by a court or other authority in respect of action taken or proposed under a power conferred by the Act.
What does "Board" mean?
The Act uses "Board" to mean the Data Protection Board of India. The Board is the statutory body established under the Act to exercise the functions and powers assigned to it. Accordingly, the jurisdictional bar in Section 39 is tied to whether the matter is one for which the Board is empowered under the Act; it is not expressed as a general exclusion of every legal proceeding involving personal data.
Scope of the bar on civil courts
Section 39 should be read according to its statutory wording. The civil-court bar applies to a "matter for which the Board is empowered" under the Act. Therefore, identifying the nature of the dispute and the particular power given to the Board is important before concluding that civil jurisdiction is excluded.
The provision also uses a separate and broad injunction clause. Where an action has been taken or is proposed under a power granted by the Act, Section 39 states that an injunction shall not be granted by a court or other authority in respect of that action.
Relationship with Section 38
Section 38 of the Digital Personal Data Protection Act, 2023 states that the Act is in addition to, and not in derogation of, other laws, while also providing that the Act prevails to the extent of a conflict. Section 39 deals more specifically with the exclusion of civil court jurisdiction and the restriction on injunctions in the circumstances described in that section.
Appeal and statutory remedies
The bar under Section 39 should be understood within the Act's own adjudicatory framework. Questions concerning proceedings before the Board and the remedies available against its orders must be considered under the applicable provisions of the Act and the rules in force. Section 39 itself is a jurisdiction-bar provision; it does not create a separate cause of action or remedy.
Commencement and 2025 Rules
The Central Government brought Section 39 into force on 13 November 2025. The Digital Personal Data Protection Rules, 2025 were notified on the same date and published by the Ministry of Electronics and Information Technology. Their commencement is phased: Rules 1, 2 and 17 to 21 commenced on publication, Rule 4 is scheduled one year after publication, and Rules 3, 5 to 16, 22 and 23 are scheduled eighteen months after publication.
Official legal resources
For the authoritative statutory text and subsequent notifications, see the Digital Personal Data Protection Act, 2023 on India Code and the Digital Personal Data Protection Rules, 2025 and related notifications on MeitY.