Authored By: Sayan Dey
Sister Nivedita University
I. Introduction
The digitalisation of everyday life has rapidly transformed personal data into a key economic and social resource. Online shopping platforms, social media networks, online payment interfaces and digital government databases increasingly accumulate and process private data. Despite the convenience and efficiency offered by these technologies, concerns regarding data breaches, frauds and misuse of personal information continue to grow. As a result, the protection of personal data has emerged as one of the most serious legal issues of the digital age.
In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court of India established a constitutional basis for data protection when it recognised the right to privacy to be a fundamental right under Article 21. The Court recognised informational privacy as an essential aspect of individual dignity and autonomy. The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first dedicated legislation concerning digital personal data. It was enacted by Parliament to address the increasing need for a privacy framework.
This article argues that the DPDP Act represents a significant step forward for India’s privacy regime, but concerns relating to government exemptions, limited user rights, institutional independence and implementation continue to persist. The legislation lays an important foundation for data governance, but further reforms are needed to ensure effective protection of informational privacy.
The discussion begins with an analysis of the constitutional and statutory foundations of data protection in India. After that, it pinpoints the main shortcomings in the existing framework while comparing the Indian model with the global practices. The article concludes by suggesting reforms to improve privacy protection while maintaining administrative and economic efficiency.
II. Constitutional and Statutory Framework
A. Constitutional Foundation of Privacy
The foundation of data protection in India can be traced to the Supreme Court’s ruling in Justice K.S. Puttaswamy (Retd.) v. Union of India. A nine-judge bench unanimously held that the right to privacy is protected under Article 21 and other provisions of Part III of the Constitution. The Court observed that the right to privacy encompasses informational control, bodily integrity and human dignity.
The Court held that any limitation on privacy must be legally justifiable, necessary, and proportionate. Any state action that compromises the right to privacy must be based on law; must pursue a legitimate aim; and must be proportionate. These principles continue to offer a constitutional benchmark against which privacy legislation must be measured.
The judgment built upon earlier decisions of the Supreme Court, including People’s Union for Civil Liberties v. Union of India (1997), which dealt with procedural safeguards against arbitrary telephone interception. Taken together, these judgments demonstrate that privacy protection in India is not confined to physical spaces but also extends to safeguards against excessive collection and use of personal information.
Another important development came in K.S. Puttaswamy v. Union of India (Aadhaar Case), which addressed the relationship between welfare delivery and informational privacy. While the Court upheld important aspects of the Aadhaar scheme, it reaffirmed that governmental collection of personal data must always conform to constitutional requirements. The Court emphasised that governmental collection of personal data must remain subject to constitutional safeguards and a balance must be maintained between administrative efficiency and individual rights.
B. The Digital Personal Data Protection Act, 2023
The DPDP Act, 2023 is India’s first comprehensive legislation governing digital personal data. The Act applies to personal data collected digitally as well as data collected offline and subsequently digitized. The Act also has limited extraterritorial application where processing relates to offering goods or services within India.
The legislation primarily operates through a consent-based framework. Personal data may generally be processed only for lawful purposes and on the basis of valid consent obtained from the individual concerned. Individuals must generally be provided with prior notice explaining the purpose of processing and the categories of data involved.
The Act introduces a number of important concepts. A Data Principal refers to the individual to whom the personal data relates, while a Data Fiduciary refers to the entity determining the purpose and means of processing such data. Certain entities may be classified as Significant Data Fiduciaries, thereby becoming subject to enhanced compliance obligations.
The Act grants Data Principals several important rights, including:
- The right to access information regarding personal data.
- The right to correction and erasure.
- The right to grievance redressal.
- The right to nominate another individual in the event of death or incapacity.
Correspondingly, Data Fiduciaries must implement reasonable security safeguards, report data breaches, and erase data once the purpose of processing has been fulfilled unless retention is legally required.
C. Digital Personal Data Protection Rules, 2025
The Digital Personal Data Protection Rules, 2025 supplement the statutory framework by offering process-related guidance regarding consent notices, breach reporting, grievance redressal and the functioning of the Data Protection Board of India. The Rules are important because they transform the Act’s high-level principles into actual rules and obligations for compliance. Nonetheless, the Act and the Rules will ultimately rely on the capacity to enforce them, institutional independence, and organizational compliance. These problems become more significant when assessing the merits and demerits of the existing framework.
III. Major Gaps in the DPDP Framework
A. Governmental Exemptions and Constitutional Concerns
Government exemptions under the DPDP Act have emerged as one of the most controversial aspects of the legislation. The Act allows the central government to exempt any particular person or class of persons from the application of any provision, if the government considers it necessary in the interest of the sovereignty, security of the State, public order or for the prevention of any offence.
Even though these objectives are legitimate, there is concern about how broad the exemption framework is and the limited safeguards for its exercise.
According to the constitutional principles laid down in Justice K.S. Puttaswamy (Retd.) v. Union of India, any restriction of privacy must satisfy legality, necessity and proportionality. Allowing extensive processing of personal data through exemptions without adequate oversight may raise constitutional concerns.
It is not a question of whether the State will process personal data. At present, state governance must gather information; be it for provisioning welfare, collecting taxes, getting health services or enforcing laws. The difficulty is realizing that this processing is accountable, transparent and proportionate. The lack of proper protections can lead to spying and misuse of private information.
B. Limited Rights of Data Principals
The DPDP Act gives Data Principals several important rights such as access, correction, erasure, grievance redressal and nomination. However, it is less comprehensive than the rights frameworks of some contemporary privacy regimes.
Importantly, the Act does not provide a general right to data portability, which allows a person to take their data and transfer it to another service provider. Such a right would promote privacy and competition in the market by reducing reliance on individual platforms.
Similarly, the Act does not explicitly recognise a broad right to be forgotten. In the digital age, personal information may be available for eternity, with lasting repercussions to reputation, employment and personal freedom. While privacy rights must be balanced with freedom of expression and public interest considerations, the absence of a clear statutory framework limits an individual’s ability to control disclosures that are outdated or unnecessary.
The Act thus favors regulatory compliance and operational flexibility over a relatively limited framework for informational self-determination.
C. Independence of the Data Protection Board
The effectiveness and independence of enforcement mechanisms are key to the success of any regulatory framework. The DPDP Act sets up the Data Protection Board of India to resolve disputes, address complaints and levy penalties for non-compliance.
Although the creation of a dedicated enforcement body is a welcome development, concerns remain about institutional independence. The process of appointment is still largely influenced by the executive branch, which leaves doubts about the Board’s independence when dealing with governmental bodies or politically sensitive issues.
Privacy regulation often requires balancing the interests of individuals, companies and public authorities. Where an enforcement body does not seem independent, it may have difficulty maintaining public confidence or resisting influence from powerful actors. Therefore, further strengthening institutional autonomy is still an important issue for future reform.
D. Consent Fatigue and Practical Implementation Challenges
The primary ground for lawful processing of data under the DPDP Act is consent. Although consent supports individual autonomy, practical limitations often reduce its effectiveness.
Digital users are regularly presented with long privacy notices, terms of service agreements and consent requests that are rarely read in full. This phenomenon, often referred to as “consent fatigue,” calls into question the notion that consent is always an informed choice.
The task presents a significant challenge in India where digital literacy levels vary considerably. Countless individuals may not have a thorough understanding of how their personal information is collected, processed, or shared. Formal compliance with consent requirements does not always translate into meaningful privacy protection.
These concerns indicate that consent should be supplemented with increased accountability duties, transparency obligations and regulatory supervision, not used as the sole method of protecting personal data.
E. Protection of Children’s Data
The increasing participation of children in digital environments poses additional regulatory challenges. Minors often provide personal information to online platforms through educational services, social media applications, gaming platforms, and digital entertainment services.
The DPDP Act provides special safeguards regarding children’s data and parental consent . However, practical implementation is difficult. Verifying parental consent can be technologically complex. Excessive compliance obligations may place significant burdens on service providers.
As digital technologies become increasingly embedded in the lives of young users, ensuring effective protection of children’s privacy will be an important regulatory priority.
IV. Comparative Perspective
A. The European Union’s GDPR
The European Union’s General Data Protection Regulation (GDPR) is widely regarded as the gold standard of data protection laws worldwide. The GDPR is very rights-based and provides a higher level of protection to data subjects compared to what the DPDP Act currently provides.
In addition to the rights to access, rectification and erasure, the GDPR provides rights to data portability, restriction of processing, the right to object to processing and protection against certain automated decision-making. These rights are part of a wider commitment to giving people control over their personal information.
The GDPR also has the advantage of a comprehensive regulatory framework supported by independent supervisory authorities with substantial investigative and enforcement powers. Such institutional design enhances accountability and promotes stable regulatory supervision.
The GDPR also lays down detailed safeguards on international data transfers in order to ensure that privacy is protected even when personal data is processed outside the European Union.
B. The United Kingdom’s Approach
The United Kingdom has a privacy regime that closely mirrors the GDPR through the UK GDPR and the Data Protection Act 2018. One of the characteristics of the British model is the role of the Information Commissioner’s Office (ICO). The ICO is an independent regulator responsible for enforcement, guidance, public awareness and policy development.
In contrast to a solely adjudicatory body, the ICO is a proactive force for compliance and for raising public awareness. This wider regulatory role offers useful insights for enhancing privacy governance in India.
C. Lessons for India
Evaluating other countries is not always fruitful, particularly given India’s unique demographic, economic and administrative circumstances. India is currently undergoing a seismic transformation. With a population of over 1.4 billion people and rapidly developing digital infrastructure, the challenges faced by India differ significantly from those encountered in Europe.
However, worldwide data shows us that there are strong privacy protections that can go along with technology innovation and economic growth. The GDPR and UK GDPR highlight the importance of enhanced user rights, independent supervisory authorities and robust accountability mechanisms.
India need not replicate foreign frameworks in their entirety. However, selectively adopting best practices—particularly in relation to regulatory independence, user rights, and transparency—could significantly strengthen the effectiveness of the DPDP framework while remaining consistent with domestic realities.
V. Reform Proposals
The analysis above demonstrates that while the DPDP Act, 2023 establishes an important foundation for privacy protection, several reforms are necessary to strengthen its effectiveness and align it more closely with constitutional principles.
A. Narrowing Governmental Exemptions
The most pressing need for reform lies in the breadth of governmental exemptions. Any exemption from privacy protections should have proper safeguards to ensure that it is necessary, proportionate and based on a legitimate purpose. There should also be some form of independent oversight to prevent misuse. These protections would allow the government to pursue legitimate objectives without unconstitutionally restricting privacy rights.
B. Expanding Data Principal Rights
Some important rights, such as data portability and a carefully balanced right to be forgotten, should be incorporated into the DPDP framework. These rights would provide an extension of individual control over personal information while increasing accountability for data processors.
Parliament might also want to debate more robust protection from automated decision-making and algorithmic profiling, especially for those processes which result in significant effects on individuals.
C. Strengthening the Independence of the Data Protection Board
An effective privacy regime requires a regulator capable of acting independently and impartially. The institutional autonomy of the Data Protection Board can be enhanced through transparent appointment procedures, longer and more secure tenures, and safeguards against undue executive influence.
A stronger and more independent Board would improve public confidence and contribute to more consistent enforcement of privacy obligations.
D. Improving Digital Literacy and Consent Mechanisms
Privacy notices should be concise, accessible and easy for ordinary users to understand. Overly complicated notices serve to destroy the goal of informed consent and help cause consent fatigue.
Government agencies, educational institutions and technology companies should also promote digital literacy initiatives that help individuals understand how their personal data is collected, processed and protected.
E. Strengthening Cross-Border Data Transfer Safeguards
As personal data increasingly flows across national boundaries, stronger safeguards are necessary to ensure consistent protection of personal data. India should consider adopting a more structured framework for evaluating international data transfers, including adequacy assessments and contractual safeguards where appropriate.
Such measures would improve trust in India’s privacy framework while supporting participation in the global digital economy.
VI. Conclusion
India’s privacy landscape is no longer operating in uncharted territory. The Digital Personal Data Protection Act, 2023 has provided the country with its first comprehensive framework for digital data protection. India now has its first ever statutory framework for the collection, processing and protection of digital personal data. The Act reveals that privacy is not a mere preference but a constitutional value associated with dignity, autonomy, and freedom of the individual.
The legislation is constitutionally valid in light of Justice K.S. Puttaswamy (Retd.) v. Union of India, where privacy was recognized as a fundamental right by the Supreme Court. Building upon this constitutional foundation, the DPDP Act provides rights to Data Principals, imposes obligations on Data Fiduciaries and establishes enforcement mechanisms. By doing so, it represents a considerable leap over the scattered privacy protections afforded by the Information Technology Act, 2000. However, it is not a finished framework but an evolving one. Broad public authorities’ exemptions, limited user rights, doubts on the independence of the Data Protection Board, and practical implementation issues raise important questions on the effectiveness of the regime.
Although these shortcomings do not take away from the value of the Act, they do indicate the need for further reforms to live up to the promise of informational privacy in the Constitution.
Experiences from other jurisdictions such as the European Union and the United Kingdom indicate that robust privacy protections can coexist with technological innovation and economic growth. India can learn a lot from these frameworks which must be suitably adapted to Indian social and regulatory contexts.
In the end, not only legislative design, but also effective implementation, institutional accountability and continued reform will be key to the success of the DPDP Act. As India moves forward on its digital journey, ensuring meaningful protection of personal data will remain critical to protecting individual liberty and public trust in the digital economy.
References and Bibliography
Cases
Justice K S Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
K S Puttaswamy (Aadhaar-5J) v Union of India (2019) 1 SCC 1.
People’s Union for Civil Liberties v Union of India (1997) 1 SCC 301.
Legislation
Constitution of India 1950.
Digital Personal Data Protection Act 2023.
Digital Personal Data Protection Rules 2025.
Information Technology Act 2000.
Data Protection Act 2018 (UK).
Regulation (EU) 2016/679 (General Data Protection Regulation).
Books
Jain MP, Indian Constitutional Law (9th edn, LexisNexis 2023).
Bhatia G, The Transformative Constitution (HarperCollins 2019).
Lynskey O, The Foundations of EU Data Protection Law (Oxford University Press 2015).
Journal Articles
Edwards L and Veale M, ‘Slave to the Algorithm? Why a Right to an Explanation is Probably Not the Remedy You are Looking For’ (2017) 16 Duke Law & Technology Review 18.
Reports
Committee of Experts under the Chairmanship of Justice B N Srikrishna, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (Government of India 2018).
PRS Legislative Research, Digital Personal Data Protection Bill, 2023: Legislative Brief.
