Can I sue under the DPDP Act? The Act has no compensation route

2 claims circulate about suing under the DPDP Act, and they are wrong in the same direction. One says the Digital Personal Data Protection Act 2023 lets you claim compensation. The other says the Act has already taken away whatever route existed before it. Neither statement survives a reading of the Gazette print.

The short answer has 3 parts. The Act gives a Data Principal no right to sue and no compensation. Section 39 bars civil courts from any matter the Data Protection Board is empowered over, and that section is in force today. And the sub section that directs the omission of section 43A of the Information Technology Act, 2000, section 44(2), is not in force, so the DPDP Act has not yet omitted anything from that Act. On the print of that older Act this site now holds, section 43A carries a compensation claim, and it is heard by an adjudicating officer rather than by a court.

Diagram headed "You cannot sue under the DPDP Act, and the doors that close are the ones in force", subtitled on this site's reading of the 2 prints, in 3 panels and a band, read as at 6 September 2026. The first panel counts the 6 words the Act does not use: compensation, compensate, damages, damage, imprisonment and punishable each appear 0 times in the Act and 0 times in the English section of the Rules, both extractions having been searched whole on 5 September 2026. Harm appears once, inside the word pharmacy, and suit appears 4 times, of which the 2 that are not the word suitable sit in the 2 provisions that close a door. So, on this site's reading of the 2 prints, no provision of the DPDP Act creates a compensation claim, a civil cause of action or a criminal offence. The second panel splits the enforcement chapter by its own commencement. In force since 13 November 2025: section 35, the immunity for the Government, the Board and its people, which names no Data Fiduciary; section 39, the bar on civil courts and on injunctions; and sections 18 to 26, the Board as an institution. Not in force today as at 6 September 2026: section 13, the grievance right; section 27, the Board's powers, and no part of it; section 28, inquiry; section 33, the penalty power; section 34, where the money goes; sections 29 and 30, appeal and execution; and section 44(2). Those are computed at 13 May 2027, bar clause 27(1)(d) at 13 November 2026, and both are interpretation until officially confirmed. The doors that close opened first. The third panel sets out the older route, which is not a court. Under section 43A of the Information Technology Act 2000 a body corporate negligent with sensitive personal data or information in a computer resource it owns, controls or operates is liable to pay damages by way of compensation to the person so affected. 5 conditions have to be met at once, and 1 of them, what makes data sensitive, is not defined in the section at all but prescribed by rule 3 of the 2011 Rules. Under section 46(1A) an adjudicating officer, not a judge, decides a claim up to rupees five crore, and the competent court has it only above that. section 61 shuts every court out of a matter that officer can determine, in wider words than section 39 uses. An appeal lies to the Appellate Tribunal within 45 days under section 57(3), then to the High Court within 60 days under section 62, all on the India Code print as on 27 June 2025. The band underneath records that a Board penalty is not your money: section 34 provides that all sums realised by way of penalties imposed by the Board under the Act shall be credited to the Consolidated Fund of India, and it names no exception, so the money goes to the State and not to you, not to a compensation fund and not divided among the people whose data was exposed, and that is as true after the computed 13 May 2027. The complaint route also runs in both directions: section 15(d) makes it a duty of the Data Principal not to register a false or frivolous grievance or complaint, entry 5 of the Schedule prices a breach of the section 15 duties at up to ten thousand rupees imposed by the Board, and section 28(12) separately lets the Board issue a warning or impose costs on a complainant, with both sitting in the 18 month group so that neither is live yet.

The 6 words the Act does not use

This is the fastest way to settle the question, because it does not depend on anybody's reading. Both extractions of the Act on file were searched whole on 5 September 2026, the Gazette print hosted by MeitY and the India Code consolidated print, and the English section of the DPDP Rules 2025 with them. Corrigendum G.S.R. 892(E), which corrects the Rules text at Gazette pages 24, 29, 32, 34 and 38, was searched for the same words on the same day and introduces none of them.

A framework that meant to hand an individual money would have to say so somewhere, and this one does not say it anywhere. The word "suit" does appear in the Act, 4 times, and 2 of those are the word "suitable" inside a definition and inside an illustration. The other 2 are in the 2 provisions that close a door rather than open one: section 35 and section 39. "Harm" is worth adding to the list for the same reason: it appears once in the Act, inside the word "pharmacy", so there is no standalone harm concept to hang a claim on either.

That is a dated absence in the instruments on file, not a claim about Indian law as a whole. Other law is expressly left standing, and section 38(1) is the provision that says so:

"The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force."

Section 38(1) of the DPDP Act 2023, Gazette page 18.

So the honest formulation is narrow, and it is the one this page stands behind, as this site's reading of the 2 prints rather than as anything the Act states: no provision of the DPDP Act creates a compensation claim, a civil cause of action or a criminal offence. Section 38(2) qualifies that rather than undoing it: where a provision of this Act conflicts with a provision of any other law in force, this Act prevails to the extent of the conflict. Where a person might still go is a question of other law, and this site does not answer it here.

Section 39, read as it is printed

Section 39 is 1 sentence, and it carries 2 separate prohibitions:

"No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act."

Section 39 of the DPDP Act 2023, Gazette page 18, marginal heading Bar of jurisdiction.

Read the 2 limbs separately, because they bind different bodies and have different reach.

3 things follow from that structure. They are this site's reading of the printed words rather than further text, and they are offered as interpretation and not as what the section states.

1. The bar is keyed to the Board's powers, not to personal data. The limb's own words confine it to a matter "for which the Board is empowered under the provisions of this Act", so on this site's reading it is not a bar on everything touching personal data. How far that description runs is a question for a court, and this page does not answer it.
2. The first limb names civil courts and nothing else. It does not name a High Court's writ jurisdiction, a consumer forum or a criminal court, and this site reads no words into it. The second limb is drafted differently and wider, at "any court or other authority", and it bars a remedy rather than a forum.
3. Nothing in section 39 gives anybody a remedy. It is subtraction only. The provision meant to supply the remedy in its place is section 27, the Board's powers and functions, and that is not in force.

That last point leaves an open question this page raises and does not answer. Section 39 is in force and section 27 is not, so what the Board is "empowered" over today, for the purposes of the bar, is not something either instrument settles. This site records it as an open question rather than resolving it, because resolving it would be a construction of an ouster clause and no text on file supplies one.

Today, the 2 doors that close are open and the door that opens is shut

This part is visible on the face of 1 notification and is easy to miss. Commencement notification G.S.R. 843(E) of 13 November 2025 brought different provisions into force on different dates, and the enforcement chapter got split down the middle.

Paragraph (a) of the notification is what puts sections 35, 38 and 39 in the first group. It appoints the date of publication as the commencement date for, among others, "sections 35, 38, 39, 40, 41, 42, 43, and sub-sections (1) and (3) of section 44". Paragraph (c) is what holds the rest back, "eighteen months from the date of publication of this gazette", and it names "sections 11 to 17", "section 27 except clause (d) of sub-section (1) of the said section", "sections 28 to 34" and "sub-section (2) of section 44" in a single list. That 18 month date is computed here as 13 May 2027 and is interpretation until officially confirmed, because the notification fixes a period and not a calendar date. Both dates would move by 1 day on the reading that the gazette was published on 14 November 2025, which this site tracks separately. Within section 27, clause (d) of sub section (1) is the only part that sits in the 1 year group of paragraph (b), computed here as 13 November 2026 and interpretation until officially confirmed, alongside section 6(9). Both of section 27's dates are still ahead, so no part of that section is in force on 5 September 2026.

Stated plainly: of the enforcement architecture, what is law today is the immunity, the jurisdiction bar and the institution itself, sections 18 to 26, which carry the Chairperson's powers under section 26, 3 powers over the Board's own administration, its officers and its Members. What is not law today is the Board's enforcement machinery, sections 27 to 34, and every right an individual would take to it. The doors that close opened first.

There is a second reason the complaint route is not available, and it is factual rather than legal. The Board was established on 13 November 2025 by a separate notification, G.S.R. 844(E), but establishment is not appointment. No notification or order appointing a Chairperson or any Member has been located: MeitY was still inviting applications for the Chairperson post and the 4 Member posts by a circular of 6 May 2026, and none was located in MeitY's published document library as enumerated on 7 October 2026, whose records with titles naming the Board are 3 on its establishment and composition, that circular, the advertisement issued with it and an item of 25 June 2026 whose own title begins Archived. A published library is not the Gazette, so that is not a certified negative. The evidence for that negative, and its limits, is set out in is the Data Protection Board operational.

Even after the computed 13 May 2027, a Board penalty is not your money

This is where most expectations break. Assume the whole framework is in force, you complain, the Board inquires, finds a significant breach and imposes a penalty under section 33. Where does the money go?

"All sums realised by way of penalties imposed by the Board under this Act, shall be credited to the Consolidated Fund of India."

Section 34 of the DPDP Act 2023, Gazette page 17.

To the State. Not to you, not to the Board that imposed it, not to a compensation fund, and not divided among the people whose data was exposed. Section 34 is 1 sentence and it names no exception. Section 33(1) lets the Board penalise "a person", which will usually be the Data Fiduciary but is not confined to one, as entry 5 of the Schedule shows further down this page. The caps that make headlines, up to Rs 250 crore for a security safeguards breach, are set out in the penalties guide; not 1 of them is a payment to an individual.

What the process does give you is a hearing of your complaint and a decision, through the pipeline described in complaint to penalty at the Data Protection Board. Section 13(3) puts a gate in front of it, in the Act's own words: "The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board." So the organisation's own grievance channel comes first, and what the Rules say about a 90 day period there, which is less settled than it looks and is not in force either, is set out in the grievance article.

One provision does connect the framework to a civil court, and it is worth naming because it points the opposite way from what people assume. Section 30(1) makes an order of the Appellate Tribunal "executable by it as a decree of civil court", and section 30(2) lets the Tribunal transmit the order to a civil court for execution. The civil court appears as an enforcer of somebody else's order, never as a forum an individual can approach.

The claim that DPDP already killed the older route is wrong today

This is the specific error worth correcting, because it is commonly stated in the present tense. Section 44(2) of the DPDP Act reads:

"The Information Technology Act, 2000 shall be amended in the following manner, namely:— (a) section 43A shall be omitted;"

Section 44(2) of the DPDP Act 2023, Gazette page 20.

"Shall be omitted" is a direction that takes effect when the provision containing it comes into force. Section 44(2) has not come into force. Paragraph (c) of G.S.R. 843(E) puts "sub-section (2) of section 44" in the 18 month group, computed here as 13 May 2027 and interpretation until officially confirmed. Section 44(1) and section 44(3) are in force, under paragraph (a), which is why section 44 reads as partly in force on this site; sub section (2) is the part that is not.

The consequence is narrow, and it is the whole point. The DPDP Act has not omitted section 43A of the Information Technology Act, 2000, because the sub section carrying that direction has not commenced. Any sentence saying the DPDP Act "has repealed" or "effectively repeals" section 43A is describing the computed 13 May 2027, interpretation until officially confirmed, and not today, and using it to explain why the DPDP Act itself offers an individual no remedy today gets the reasoning backwards.

The same sub section does 2 more things, and they show why the omission is coherent rather than arbitrary:

"(b) in section 81, in the proviso, after the words and figures “the Patents Act, 1970”, the words and figures “or the Digital Personal Data Protection Act, 2023” shall be inserted; and (c) in section 87, in sub-section (2), clause (ob) shall be omitted."

Clauses (b) and (c) of section 44(2) of the DPDP Act 2023, Gazette page 20.

Clause (ob) of section 87(2) is the power to prescribe the 2 things section 43A leaves undefined. So when section 44(2) arrives, the compensation section and the rule making power behind it go together. All 3 limbs are in the same 18 month group and not 1 of them is in force.

What section 43A actually says

Until 5 September 2026 this page stopped at the sentence above, because this site held no print of the Information Technology Act, 2000 and would not describe an Act it could not quote. That gap is now closed. The India Code consolidated print of Act No. 21 of 2000, 44 pages, is on file and registered, and this section quotes it. One thing has to be said before any of it: the print states the law as India Code had consolidated it on 27 June 2025, which is the date its own first page carries, so everything below is a statement about that print and not a claim about every day since.

"Compensation for failure to protect data. – Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected."

Section 43A of the Information Technology Act, 2000, page 21 of the India Code print.

Read it against the DPDP Act and the difference is immediate. The word the DPDP Act never uses, compensation, is this section's own heading. The footnote the print carries beside the section dates its insertion to 27 October 2009.

But it is a narrower thing than the phrase "the old compensation route" suggests, and the narrowing is in the text itself. 5 conditions have to be met at once.

Clause (iii) is the one that carries the weight, because it is the reason the section cannot be applied from its own words. Clause (ii) at least says what a reasonable practice is FOR, protecting the information from unauthorised access, damage, use, modification, disclosure or impairment, before it sends the content of the standard out to an agreement, a law or a prescription. Clause (iii) says nothing at all about what makes data sensitive:

"such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit."

What clause (iii) of the Explanation to section 43A defines "sensitive personal data or information" to mean, page 22 of the India Code print.

That prescription exists, and it is now on file here. It is rule 3 of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, notified as G.S.R. 313(E) on 11 April 2011 under clause (ob) of sub-section (2) of section 87 read with section 43A itself, and it lists 8 clauses with a proviso taking out anything freely available or accessible in public domain or furnished under the Right to Information Act, 2005. That Gazette print is read in full, with what section 44(2) of the DPDP Act does and does not do to it, in the SPDI Rules 2011 and the DPDP Act. What it changes for this page is narrow but real: clause (iii) sends a reader somewhere rather than nowhere, so the subject matter of a section 43A claim can be identified from a document instead of being left open.

Where a section 43A claim is heard, and it is not a civil court

This is the part most summaries skip, and it changes the practical answer. On the print on file, a section 43A claim does not go in front of a judge in a civil court. It goes to an official first, which is the same shape as the DPDP Act's own complaint route to the Board, though the 2 forums are different things: 1 is an officer and the other is a body.

"The adjudicating officer appointed under sub-section (1) shall exercise jurisdiction to adjudicate matters in which the claim for … damage does not exceed rupees five crore: Provided that the jurisdiction in respect of the claim for … damage exceeding rupees five crores shall vest with the competent court."

Section 46(1A) of the Information Technology Act, 2000, page 22 of the India Code print. Each elision stands for the print's own mark that words were removed there by amendment, which is the subject of the next paragraph. No word of the text as it now stands is omitted.

That elision earns a paragraph of its own, because the words it stands for are the words a generated answer reached for. Asked on 5 September 2026 who decides a data breach compensation claim, an answer gave this very sub section as "the claim for injury or damage does not exceed rupees five crore". The words "injury or" are at neither point in the print on file: footnote 9 on page 22 records that they were omitted at both by the Jan Vishwas (Amendment of Provisions) Act, 2023 (18 of 2023) with effect from 30 November 2023. The word "injury" survives exactly twice in all 44 pages, once in that footnote and once in section 66F on cyber terrorism, and neither is the operative text of section 46. So an answer quoting "injury or damage" is quoting the sub section as it stood before 30 November 2023. That omission is 1 of 16 directions the Jan Vishwas Act aimed at this statute in a single Schedule entry, and the same entry widened section 46(1) from contraventions "under this Chapter" to "under this Act", which is what the officer described here now has jurisdiction over; what the Jan Vishwas Act changed in the IT Act, and what it left alone sets out all 16 against the Gazette print.

So the forum is an adjudicating officer, appointed by the Central Government from officers not below the rank of a Director to the Government of India or an equivalent State Government officer, up to Rs 5 crore, and a court only above that. Section 47 tells that officer how to size the award, by the gain made, the loss caused and whether the default was repeated. From there section 57(1) gives any person aggrieved by an adjudicating officer's order an appeal, and section 57(3) sets the period at 45 days from receipt of the order, extendable for sufficient cause. Section 57(2) closes 1 door: no appeal lies from an order the parties consented to. The forum is the Telecom Disputes Settlement and Appellate Tribunal, which section 48(1) constitutes as the Appellate Tribunal for that Act and which is the same tribunal the DPDP Act names in its own section 2(a) and appeals to in section 29. Section 62 allows a further appeal to the High Court within 60 days of communication, on a question of fact or law, extendable by up to 60 more.

And the door to the ordinary civil court is shut by a provision that will look familiar:

"Civil court not to have jurisdiction. – No court shall have jurisdiction to entertain any suit or proceeding in respect of any matter which an adjudicating officer appointed under this Act or the … [Appellate Tribunal] constituted under this Act is empowered by or under this Act to determine and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power conferred by or under this Act."

Section 61 of the Information Technology Act, 2000, page 25 of the India Code print. The square brackets are the print's own, marking substituted words.

It is the same 2 limb shape as section 39 of the DPDP Act, a jurisdiction bar plus an injunction bar in 1 sentence, and it is not the same words. Section 39 opens "No civil court shall have the jurisdiction"; section 61 opens "No court shall have jurisdiction", which is wider, and it is keyed to what an adjudicating officer or the Appellate Tribunal is empowered to determine rather than to what the Board is. So the honest headline for the older route is not "you can sue under the IT Act". It is that the print carries a compensation claim, that the claim is heard by an adjudicating officer rather than by a court, and that it is subject to the 5 conditions above.

One section that section 44(2) does not touch. Section 43, without the A, also ends in the words "damages by way of compensation to the person so affected", and the DPDP Act leaves it alone. It is not a substitute, and on this site's reading it addresses a different situation: its opening words are "If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network", so it is aimed at conduct done without permission rather than at the negligence of an organisation that holds the data with permission. That reading is this site's interpretation of the chapeau and not a statement anybody has adjudicated.

The limits that stay, and there are 2. The first is the date. The print on file is dated 27 June 2025, this page describes sections 22, 35, 43, 43A, 45, 46, 47, 48, 57, 61 and 62 from it, and this site has located no instrument between that date and 7 September 2026 touching any of them, having re run its India Code amending Act tripwire on the later date against an archive of that collection dated 6 September 2026. It does not assert that none exists. The second is the missing half. Section 43A sends both the sensitive category and the security standard out to be prescribed under clause (ob) of section 87(2), and this site holds no official print of anything prescribed under that power, so it says nothing about what those rules contain or which data they reach. Before relying on any of this, check the current print and take advice; this page reads documents and is not a legal opinion.

2 figures get attached to section 43A, and neither one belongs to it

A recurring error in circulating answers to this question is not about the law but about its arithmetic. Asked on 7 September 2026 whether a person can claim compensation for a data breach, a generated answer listed section 43A of the Information Technology Act, 2000 among the alternatives to the DPDP Act and then described it in these words: "Section 43A of IT Act 2000: Section 43A compensation is capped at Rs. 25,000 unless actual damages are substantially proved". There are 2 mistakes in that single sentence, and each of them moves a real figure onto a provision it was never in.

Section 43A carries no ceiling at all. Its operative sentence is quoted in full above, and it ends at "damages by way of compensation to the person so affected" and stops. Measured on 7 September 2026 over this site's extraction of that print, the strings rupee, lakh, crore and thousand each occur 0 times in the whole of section 43A. The span is 1,630 characters after the extractor's own page marker is taken out, and it runs from the marginal heading Compensation for failure to protect data to the words immediately before 44. Penalty for failure to furnish information, so it covers the operative sentence, the footnote block that closes page 21, and all 3 clauses of the Explanation on page 22. What it deliberately stops short of is page 22's own footnote block, which does carry money words, because those footnotes belong to sections 44 and 45 rather than to section 43A. What the print supplies instead is a direction about method rather than a limit on amount. Section 47 requires the adjudicating officer, while adjudging the quantum of compensation, to have due regard to 3 factors: the amount of gain of unfair advantage made as a result of the default, wherever quantifiable, the amount of loss caused to any person as a result of the default, and the repetitive nature of the default. The words gain of unfair advantage are the print's own, where a reader would expect gain or unfair advantage. Section 47 is keyed to “the quantum of compensation under this Chapter”, and on the print's own table of contents Chapter IX runs from section 43 to section 47, so section 43A is inside it. That step matters because the Jan Vishwas Act widened the neighbouring section 46(1) from a contravention under this Chapter to one under this Act and left section 47 keyed to the Chapter, so the 2 provisions now have different reach. It makes no difference to a section 43A claim, which is inside Chapter IX either way. So a section 43A award is bounded by what a claimant proves and by that officer's reasons, and not by a number in the statute.

Rs 25,000 was section 45's figure, and it was substituted with effect from 30 November 2023. Section 45 is the residuary penalty, the provision that catches a contravention of anything made under the Act for which no penalty is separately provided. It is a different section, aimed at a different thing, and it is where the figure lived. 2 things have to be said precisely, because this is a page about a figure attached to the wrong provision. Parliament's own act was the assent of 11 August 2023: section 1(2) of the amending Act leaves commencement to a date the Central Government appoints by notification, and may appoint different dates for different enactments in the Schedule, so 30 November 2023 is an appointed date and not a parliamentary one. This site's evidence for it is footnote 5 on page 22 of the consolidated print, and the appointing notification is not on file here. And the figure was taken out of section 45, not out of the Act: twenty five thousand rupees survives twice in the current print, in section 22(2)(c) and section 35(2), where it is a ceiling on a prescribed fee and not a penalty or a compensation figure. The amending instrument is what proves the attribution, because a consolidated print shows only what a provision says now. Read the 2 quotes below against each other and a second change appears that no figure captures: the old words offered compensation to the person affected or a penalty, each capped at the same twenty five thousand rupees, and the words substituted for them are expressly cumulative.

"(C) In section 45,— (i) for the words “rules or regulations”, the words “rules, regulations, directions or orders” shall be substituted; (ii) for the words “compensation not exceeding twenty-five thousand rupees to the person affected by such contravention or a penalty not exceeding twenty-five thousand rupees”, the following shall be substituted, namely:—"

Limb (C) of entry 32 of the Schedule to the Jan Vishwas (Amendment of Provisions) Act, 2023, page 60 of the Gazette print on file.

The words it put in their place are printed on the next page:

"penalty not exceeding one lakh rupees, in addition to compensation to the person affected by such contravention not exceeding — (a) ten lakh rupees, by an intermediary, company or body corporate; or (b) one lakh rupees, by any other person."

The words substituted into section 45 by that limb, page 61 of the same print.

So on that print section 45 sets a penalty of up to one lakh rupees, and in addition to it compensation of up to ten lakh rupees to the person affected where the contravener is an intermediary, a company or a body corporate, and up to one lakh where it is anybody else. The words in addition to are what make the 2 limbs cumulative, and the penalty limb is not payable to the person affected. Where it does go, this page will not say: the strings Consolidated Fund and credited to appear 0 times across all 44 pages of the print, measured on 7 September 2026, so that older Act has no provision answering the question section 34 answers for the DPDP Act, and the contrast is a silence rather than a difference. On the 2 printed figures, the compensation limb against a company went from twenty five thousand rupees to ten lakh, which is 40 times, and the limb against any other person went from twenty five thousand to one lakh, which is 4 times. The consolidated print does not disclose this by itself: footnote 5 on page 22 records the substitution only as being made "for certain words", so the earlier figure is recoverable only from the amending Act, and what the Jan Vishwas Act changed in the IT Act sets this out with the other 15 directions in the same entry.

Rs 5 crore is a jurisdiction line and not a cap on liability. That figure is real and it does sit in this chapter, but section 46(1A), quoted above, uses it to divide 2 forums rather than to limit an award: the adjudicating officer decides a claim that does not exceed rupees five crore, and the competent court has anything above it. A cap tells you the most you can be awarded. A jurisdiction line tells you who decides. Attaching it to section 43A as a ceiling inverts the rule, because above Rs 5 crore a claim does not shrink to the limit, it moves to a different forum.

And the fallback offered alongside the wrong cap runs into section 61. The same answer also offered a tort based claim in a civil court as a route. That phrase is reported here rather than quoted, because no capture of it is archived on this site. Section 61, quoted above, shuts every court out of any matter which an adjudicating officer or the Appellate Tribunal is empowered by or under that Act to determine. On this site's reading, where the facts are the ones section 43A describes, a body corporate negligent with sensitive personal data or information in a computer resource it owns, controls or operates, those are precisely a matter the adjudicating officer is empowered to determine, so putting the same claim to a civil court under the label of tort meets the bar rather than avoiding it. That reading is this site's interpretation of the words of section 61 and not a proposition it has found adjudicated. What is not interpretation is the comparison: section 61 says "No court", where section 39 of the DPDP Act says "No civil court", and section 61 is keyed to what that officer and that Tribunal may determine rather than to what the Board may. 1 thing pulls the other way and this page does not resolve it: the marginal heading the print gives section 61 is "Civil court not to have jurisdiction", which is narrower than the operative words beneath it. The narrower reading is enough for what this section needs, because the route being examined is a suit in a civil court.

The individual has duties, and 1 of them is priced

A page about suing should say the thing nobody advertises: the complaint route runs in both directions. Section 15 puts 5 duties on a Data Principal, and clause (d) is this:

"to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board;"

Section 15(d) of the DPDP Act 2023, Gazette page 10.

Entry 5 of the Schedule pairs a breach of the section 15 duties with a penalty that may extend to ten thousand rupees, so Rs 10,000 is the ceiling, imposed by the Board through section 33 and not by any court. Separately, section 28(12) lets the Board act inside the proceeding itself:

"At any stage after receipt of a complaint, if the Board is of the opinion that the complaint is false or frivolous, it may issue a warning or impose costs on the complainant."

Section 28(12) of the DPDP Act 2023, Gazette page 15.

It is the only costs provision in the Act, and it runs against the complainant. Both section 15 and section 28 sit in the 18 month group, so neither is live yet, and neither is a reason to hold back a genuine complaint. It is a reason to be accurate in one. The full set of rights and duties is set out in your rights under the DPDP Act, and the rights tool walks through what you can ask for and when.

The honest summary

What to do instead, today

1. Use the organisation's own grievance channel and keep the record. It is the route section 13 will formalise, and a documented complaint with a documented response is what a later Board complaint would be built on. The breach response guide shows what that record looks like from the other side of the table.
2. Do not wait for a DPDP remedy the Act does not contain. No amount of commencement turns section 33 into a payment to you; section 34 fixes that.
3. Watch 2 dates rather than 1. The 1 year group, computed 13 November 2026, moves only section 6(9) and clause 27(1)(d). The route in this article turns on the 18 month group, computed 13 May 2027. Each is computed from a period stated in G.S.R. 843(E) rather than printed as a calendar date, and each is interpretation until officially confirmed, and what is in force today tracks them provision by provision.
4. Take a separate legal view on other law. Section 38(1) leaves other law standing, subject to the conflict rule in section 38(2), and this page deliberately stops at the edge of the DPDP instruments rather than guessing at what lies beyond them.