Punjab & Haryana High Court Issues Notice To Google, Centre On Student's Plea For Recovery Of Locked Gmail Accounts

The Punjab and Haryana High Court has issued notice on a writ petition filed by a 19-year-old engineering student who has been locked out of his Google accounts since his mobile phone was stolen in August 2024.

He says Google has not complied with a Grievance Appellate Committee (GAC) order directing it to help him recover his data.

Justice Tribhuvan Dahiya issued notice of motion, and notice on the prayer for interim directions as well. Counsel for the Union of India accepted notice and sought time to file a reply. The Court also issued notice to Google India and listed the matter on November 20.

According to the petition, the petitioner's handset was stolen on August 18, 2024. It was the only trusted device linked to his three accounts with Google, and all three became inaccessible.

He alleges that Google's recovery system verifies his registered mobile number but then asks for a code that can only be delivered to the locked accounts themselves. This creates a loop with no option for human verification.

The petitioner says he then filed complaints with Google, filed RTI applications about those complaints, lodged a cyber complaint, filed an earlier writ petition, CWP No. 25369 of 2026.

That earlier petition was disposed of on August 13, 2026 with a direction to the appellate authority to decide his appeal under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 within 30 days.

On August 21, 2026, the GAC directed Google to provide appropriate guidance and support to help the petitioner recover data from his Gmail accounts. The petitioner contends that Google has taken no action since. His later emails, including one dated September 9, 2026, have gone unanswered, he claims.

He also points out that the two-year period under Google's Inactive Account Policy, counted from his last access, expired on August 18, 2026. As a result, he says, his data could be deleted at any moment.

The plea argues that Google is a Data Fiduciary and he is a Data Principal under the Digital Personal Data Protection Act, 2023. He contends that a “personal data breach” under Section 2(u) includes loss of access. He relies on Section 8(5) read with Rule 6(1)(d) of the DPDP Rules, 2025, which require measures such as data backups to ensure continued processing if access is lost. He also cites Section 27, which empowers the Data Protection Board to direct remedial measures.

Google holds the data and can restore it, yet refuses to do so, petitioner alleges. He argues this is contrary to Rules 3(1)(m) and 3(1)(n) of the IT Rules, 2021, and to Article 21.

Google's policy allows deletion two years after the last access. He argues that Sections 8(7) and 8(8) of the DPDP Act, read with Rule 8 and the Third Schedule of the DPDP Rules, require the data to be preserved for three years from the Data Principal's last request.

Mr. Satyam Tandon, Advocate for the petitioner.

Mr. Dheeraj Jain, Senior Advocate with Ms. Amrita Singh, Advocate for the respondents/UOI.