SC issues notice to MeitY on PILs challenging DPDP Act

The Supreme Court has issued a notice to the ministry of electronics and IT on multiple public interest litigations (PILs) challenging the Digital Personal Data Protection Act, 2023.

At least four PILs argue that the Act violates fundamental constitutional rights by failing to adequately restrict the government’s powers to access and handle citizens’ personal data.

The notice, issued on 12 March, followed a PIL filed by the legal advocacy group Software Freedom Law Centre (SFLC) under Writ Petition (Civil) No. 275 of 2026. The order was uploaded on the top court’s website on Monday.

Dhruv Garg, founding partner at public policy consultancy firm India Governance and Policy Project (Igap), said that the Supreme Court’s issuance of a notice in response to the PIL cited above “does not indicate any stance of the apex court in the matter on merits”.

“While the Court’s issuance of notice may be considered as prima facie interest of the court in hearing the matter, this does not necessarily mean that the court agrees with the content of the petition,” Garg said. “Going forward, what will give an insight into the strength of the petitions will be the substantive proceedings and arguments that will commence after the response by the government is submitted.”

The case is scheduled to be heard on 23 March.

Mint’s emailed query to Meity remained unanswered, while officials with direct knowledge of the Act did not respond to a request for a comment.

What the petition says

The latest plea seeks to strike down or limit provisions that allegedly give the Centre “excessive control over data governance”, create “surveillance risks without adequate safeguards”, weaken civil liberties available to individuals affected by data breaches, and undermine the independence of the Data Protection Board.

The petition, which the apex court has now tagged with three other similar PILs on other aspects of the DPDP Act such as the Right to Information (RTI) Act and freedom of the press, claimed the Act laid foundation for the Centre to “process personal data in a legal vacuum”, and went against the Supreme Court’s landmark Puttaswamy verdict that deemed right to privacy as a fundamental right.

To be sure, on 16 February, a three-judge bench comprising chief justice Surya Kant refused to stay the implementation of DPDP Act on a separate appeal that has challenged the law on the grounds of constitutionality. The apex court referred the appeal to a five-judge bench, with the CJI stating that the court will hear all such matters to produce a verdict before the law is implemented this November.

“The Supreme Court issuing a notice to the Centre asking for its responses does mean that the case was admitted, and that the Court sees the questions being raised around data privacy and data access to be legitimate concerns. We’re now hoping for the Centre to respond on the matter, including the other matters that have been tagged together in light of concerns with the DPDP Act’s powers to the Centre,” Mishi Chaudhary, one of the lawyers representing the petitioners in this case, told Mint.

Chaudhary added that while there may not be a direct precedent of material changes to the law itself, “the Supreme Court does have power to decide if a law is in constitutional violation, and its verdict will impact the law accordingly”.

Long journey

India’s first dedicated data protection law, expected to be enforced from November 2026, has already had a long journey to codification. In July 2018, an expert committee led by former justice B.N. Srikrishna submitted the first draft of the 176-page Personal Data Protection Bill. The bill was tabled in Parliament in December 2019 and later referred to a joint parliamentary committee.

Two years later, the committee submitted its revised version, renaming it the Data Protection Bill, 2021. However, the bill was withdrawn in August 2022. It resurfaced in November that year in its current form, when the Centre released a fresh draft for public consultation.

In July 2023, the DPDP Act cleared both houses of Parliament and received the President’s assent in August. The rules were notified in November 2025, paving the way for the law’s implementation.