Can I sue under the DPDP Act? The Act has no compensation route

2 claims circulate about suing under the DPDP Act, and they are wrong in the same direction. One says the Digital Personal Data Protection Act 2023 lets you claim compensation. The other says the Act has already taken away whatever route existed before it. Neither statement survives a reading of the Gazette print.

The short answer has 3 parts. The Act gives a Data Principal no right to sue and no compensation. Section 39 bars civil courts from any matter the Data Protection Board is empowered over, and that section is in force today. And the sub section that directs the omission of section 43A of the Information Technology Act, 2000, section 44(2), is not in force, so the DPDP Act has not yet omitted anything from that Act.

The 6 words the Act does not use

This is the fastest way to settle the question, because it does not depend on anybody's reading. Both extractions of the Act on file were searched whole on 5 September 2026, the Gazette print hosted by MeitY and the India Code consolidated print, and the English section of the DPDP Rules 2025 with them.

A framework that meant to hand an individual money would have to say so somewhere, and this one does not say it anywhere. The word "suit" does appear in the Act, 4 times, and 2 of those are the word "suitable" inside a definition and inside an illustration. The other 2 are in the 2 provisions that close a door rather than open one: section 35 and section 39. "Harm" is worth adding to the list for the same reason: it appears once in the Act, inside the word "pharmacy", so there is no standalone harm concept to hang a claim on either.

That is a dated absence in the instruments on file, not a claim about Indian law as a whole. Other law is expressly left standing, and section 38(1) is the provision that says so:

"The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force."

Section 38(1) of the DPDP Act 2023, Gazette page 18.

So the honest formulation is narrow, and it is the one this page stands behind, as this site's reading of the 2 prints rather than as anything the Act states: no provision of the DPDP Act creates a compensation claim, a civil cause of action or a criminal offence. Section 38(2) qualifies that rather than undoing it: where a provision of this Act conflicts with a provision of any other law in force, this Act prevails to the extent of the conflict. Where a person might still go is a question of other law, and this site does not answer it here.

Section 39, read as it is printed

Section 39 is 1 sentence, and it carries 2 separate prohibitions:

"No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act."

Section 39 of the DPDP Act 2023, Gazette page 18, marginal heading Bar of jurisdiction.

Read the 2 limbs separately, because they bind different bodies and have different reach.

3 things follow from that structure. They are this site's reading of the printed words rather than further text, and they are offered as interpretation and not as what the section states.

1. The bar is keyed to the Board's powers, not to personal data. The limb's own words confine it to a matter "for which the Board is empowered under the provisions of this Act", so on this site's reading it is not a bar on everything touching personal data. How far that description runs is a question for a court, and this page does not answer it.
2. The first limb names civil courts and nothing else. It does not name a High Court's writ jurisdiction, a consumer forum or a criminal court, and this site reads no words into it. The second limb is drafted differently and wider, at "any court or other authority", and it bars a remedy rather than a forum.
3. Nothing in section 39 gives anybody a remedy. It is subtraction only. The provision meant to supply the remedy in its place is section 27, the Board's powers and functions, and that is not in force.

That last point leaves an open question this page raises and does not answer. Section 39 is in force and section 27 is not, so what the Board is "empowered" over today, for the purposes of the bar, is not something either instrument settles. This site records it as an open question rather than resolving it, because resolving it would be a construction of an ouster clause and no text on file supplies one.

Today, the 2 doors that close are open and the door that opens is shut

This part is visible on the face of 1 notification and is easy to miss. Commencement notification G.S.R. 843(E) of 13 November 2025 brought different provisions into force on different dates, and the enforcement chapter got split down the middle.

Paragraph (a) of the notification is what puts sections 35, 38 and 39 in the first group. It appoints the date of publication as the commencement date for, among others, "sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44". Paragraph (c) is what holds the rest back, "eighteen months from the date of publication of this gazette", and it names "sections 11 to 17", "section 27 except clause (d) of sub-section (1) of the said section", "sections 28 to 34" and "sub-section (2) of section 44" in a single list. That 18 month date is computed here as 13 May 2027 and is interpretation until officially confirmed, because the notification fixes a period and not a calendar date. Both dates would move by 1 day on the reading that the gazette was published on 14 November 2025, which this site tracks separately. Within section 27, clause (d) of sub section (1) is the only part that sits in the 1 year group of paragraph (b), computed here as 13 November 2026 and interpretation until officially confirmed, alongside section 6(9). Both of section 27's dates are still ahead, so no part of that section is in force on 5 September 2026.

Stated plainly: of the enforcement architecture, what is law today is the immunity, the jurisdiction bar and the institution itself, sections 18 to 26, which carry the Chairperson's powers under section 26, 3 powers over the Board's own administration, its officers and its Members. What is not law today is the Board's enforcement machinery, sections 27 to 34, and every right an individual would take to it. The doors that close opened first.

There is a second reason the complaint route is not available, and it is factual rather than legal. The Board was established on 13 November 2025 by a separate notification, G.S.R. 844(E), but establishment is not appointment. As at 5 September 2026 this site has located no notification or order appointing a Chairperson or any Member, and MeitY was still inviting applications for the Chairperson post and the 4 Member posts by a circular of 6 May 2026. The evidence for that negative, and its limits, is set out in is the Data Protection Board operational.

Even after the computed 13 May 2027, a Board penalty is not your money

This is where most expectations break. Assume the whole framework is in force, you complain, the Board inquires, finds a significant breach and imposes a penalty under section 33. Where does the money go?

"All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India."

Section 34 of the DPDP Act 2023, Gazette page 17.

To the State. Not to you, not to the Board that imposed it, not to a compensation fund, and not divided among the people whose data was exposed. Section 34 is 1 sentence and it names no exception. Section 33(1) lets the Board penalise "a person", which will usually be the Data Fiduciary but is not confined to one, as entry 5 of the Schedule shows further down this page. The caps that make headlines, up to Rs 250 crore for a security safeguards breach, are set out in the penalties guide; not 1 of them is a payment to an individual.

What the process does give you is a hearing of your complaint and a decision, through the pipeline described in complaint to penalty at the Data Protection Board. Section 13(3) puts a gate in front of it, in the Act's own words: "The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board." So the organisation's own grievance channel comes first, and what the Rules say about a 90 day period there, which is less settled than it looks and is not in force either, is set out in the grievance article.

One provision does connect the framework to a civil court, and it is worth naming because it points the opposite way from what people assume. Section 30(1) makes an order of the Appellate Tribunal "executable by it as a decree of civil court", and section 30(2) lets the Tribunal transmit the order to a civil court for execution. The civil court appears as an enforcer of somebody else's order, never as a forum an individual can approach.

The claim that DPDP already killed the older route is wrong today

This is the specific error worth correcting, because it is commonly stated in the present tense. Section 44(2) of the DPDP Act reads:

"The Information Technology Act, 2000 shall be amended in the following manner, namely:— (a) section 43A shall be omitted;"

Section 44(2) of the DPDP Act 2023, Gazette page 20.

"Shall be omitted" is a direction that takes effect when the provision containing it comes into force. Section 44(2) has not come into force. Paragraph (c) of G.S.R. 843(E) puts "sub-section (2) of section 44" in the 18 month group, computed here as 13 May 2027 and interpretation until officially confirmed. Section 44(1) and section 44(3) are in force, under paragraph (a), which is why section 44 reads as partly in force on this site; sub section (2) is the part that is not.

The consequence is narrow, and it is the whole point. The DPDP Act has not omitted section 43A of the Information Technology Act, 2000, because the sub section carrying that direction has not commenced. This page stops there: holding no official print of the Information Technology Act, 2000, this site does not state what that Act contains on 5 September 2026 and does not rule out any other instrument having touched section 43A. What the 2 documents on file do support is this: any sentence saying the DPDP Act "has repealed" or "effectively repeals" section 43A is describing the computed 13 May 2027, interpretation until officially confirmed, and not today, and using it to explain why the DPDP Act itself offers an individual no remedy today gets the reasoning backwards.

What this site does not claim here. dpdprules.org holds no official print of the Information Technology Act, 2000, so this page makes no statement about what section 43A provides, what it requires, or what remedy it supports. The claim above rests on 2 documents that are on file and nothing else: the DPDP Act's own section 44(2), which names section 43A, and the commencement notification, which does not bring that sub section into force. Registering an official copy of the Information Technology Act, 2000 is recorded here as outstanding work.

The individual has duties, and 1 of them is priced

A page about suing should say the thing nobody advertises: the complaint route runs in both directions. Section 15 puts 5 duties on a Data Principal, and clause (d) is this:

"to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board;"

Section 15(d) of the DPDP Act 2023, Gazette page 10.

Entry 5 of the Schedule pairs a breach of the section 15 duties with a penalty that may extend to ten thousand rupees, so Rs 10,000 is the ceiling, imposed by the Board through section 33 and not by any court. Separately, section 28(12) lets the Board act inside the proceeding itself:

"At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant."

Section 28(12) of the DPDP Act 2023, Gazette page 15.

It is the only costs provision in the Act, and it runs against the complainant. Both section 15 and section 28 sit in the 18 month group, so neither is live yet, and neither is a reason to hold back a genuine complaint. It is a reason to be accurate in one. The full set of rights and duties is set out in your rights under the DPDP Act, and the rights tool walks through what you can ask for and when.

The honest summary

What to do instead, today

1. Use the organisation's own grievance channel and keep the record. It is the route section 13 will formalise, and a documented complaint with a documented response is what a later Board complaint would be built on. The breach response guide shows what that record looks like from the other side of the table.
2. Do not wait for a DPDP remedy the Act does not contain. No amount of commencement turns section 33 into a payment to you; section 34 fixes that.
3. Watch 2 dates rather than 1. The 1 year group, computed 13 November 2026, moves only section 6(9) and clause 27(1)(d). The route in this article turns on the 18 month group, computed 13 May 2027. Each is computed from a period stated in G.S.R. 843(E) rather than printed as a calendar date, and each is interpretation until officially confirmed, and what is in force today tracks them provision by provision.
4. Take a separate legal view on other law. Section 38(1) leaves other law standing, subject to the conflict rule in section 38(2), and this page deliberately stops at the edge of the DPDP instruments rather than guessing at what lies beyond them.