Supreme Court directs MeitY to consider PIL for recovery of stolen Indian data under DPDP Act

Overview The Supreme Court on 19 May 2026 asked the MeitY to treat a PIL as a supplementary representation. The petition, filed by cyber‑security consultant Nitish Kumar , seeks a robust mechanism to recover or destroy personal data of Indians that has been stolen and stored on foreign servers. Key Developments The bench, comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and Vipul M. Pancholi, declined to entertain the PIL on procedural grounds, directing the petitioner to approach the government. The petition urges the immediate operationalisation of the DPDP Act and the formation of a SIT to monitor data‑theft investigations. The petitioner warns that stolen data, including fingerprints and personal identifiers, is being weaponised for "digital arrests" and extortion across at least five foreign jurisdictions. The Court highlighted the technical nature of the issue, recommending administrative and technological expertise rather than judicial intervention at this stage. Important Facts • The stolen data is alleged to reside on servers in five foreign countries, making direct recovery difficult without an extradition treaty . • The petitioner argues that even if the data cannot be brought back, it can be "restructured and destroyed" to prevent misuse. • The Court allowed the petitioner to submit the matter as a supplementary representation to MeitY, effectively converting the PIL into a policy recommendation. UPSC Relevance The case underscores the intersection of law, technology and governance – a frequent theme in GS2 (Polity) and GS3 (Technology & Governance) . Aspirants should note: The role of the Supreme Court in shaping policy through judicial directions. The importance of the DPDP Act in the broader context of data protection, cyber security and digital rights. The procedural use of PIL and its conversion into a governmental representation. The need for inter‑governmental coordination, especially with foreign jurisdictions, highlighting the relevance of extradition treaties . Way Forward MeitY is expected to: Examine the petitioner’s representation and draft a concrete mechanism for data recovery or destruction. Accelerate the operationalisation of the DPDP Act , including guidelines for cross‑border data requests. Consider constituting a SIT to coordinate with foreign agencies and monitor compliance. Engage with other nations to negotiate or strengthen extradition treaties for cyber‑crimes. These steps will help safeguard Indian citizens’ digital privacy and curb the rise of "digital arrests" that threaten personal liberty.