Section 39: Bar of jurisdiction

Section 39 restricts the power of regular civil courts to hear cases related to data protection matters covered by this Act. Specifically, it states that no civil court has the jurisdiction to entertain any lawsuit or proceeding if the issue is something the Data Protection Board of India (the Board) is empowered to handle. If the Act gives the Board the authority to deal with a specific matter, individuals and organizations cannot bypass the Board by taking that issue directly to a civil court.\n\nThe section also prevents any court or other authority from granting an injunction regarding actions taken under the Act. An injunction is a legal order that stops a person or entity from taking a specific action. Because of this rule, courts cannot issue orders to pause, block, or interfere with any action that is being taken, or is planned to be taken, using the powers granted by the provisions of this Act.

Key points

• Civil courts do not have the jurisdiction to hear lawsuits or proceedings about matters that the Board is empowered to handle.
• No court or other authority can grant an injunction against actions taken or planned to be taken under the powers of this Act.

Common misreadings

• A person might think they can sue a Data Fiduciary in a regular civil court for a data breach, but if the Board has the power to handle it, civil courts cannot hear the case.
• A person might think a court can issue an order to pause an ongoing Board investigation, but the Act explicitly forbids courts from granting injunctions against actions taken under the Act's powers.