Authored By: Semparuthi Ravichandran
Government Law College,Chengalpattu
Introduction
Personal data has become the principal currency of the modern economy, and most data subjects only dimly understand the terms of the exchange they enter into each time they search, shop, travel, or authenticate online. For a jurisdiction of nearly 1.4 billion people transitioning rapidly into a digital-first economy, the absence of a comprehensive data protection framework was, for over two decades, a conspicuous legislative gap. The enactment of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) — following six years of drafting, three earlier legislative attempts, and one landmark constitutional judgment — finally gave India a dedicated statute governing the processing of digital personal data.
This article undertakes a critical, rather than descriptive, examination of the DPDP Act and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) that operationalise it. It argues that while the statute represents a necessary and overdue codification of the constitutional right to informational privacy recognised in Justice K.S. Puttaswamy v. Union of India, its architecture embeds three structural weaknesses that risk hollowing out the very protection it purports to create: an unusually broad and insufficiently checked exemption for government processing; an adjudicatory, rather than regulatory, Data Protection Board whose composition compromises its functional independence; and a consequential amendment to the Right to Information Act, 2005 (the “RTI Act”) that recalibrates the balance between privacy and transparency firmly in favour of opacity. The analysis proceeds in six parts. Part II traces the constitutional foundation of the right to privacy. Part III outlines the salient features of the Act and its implementing Rules. Part IV describes the phased rollout currently underway. Part V interrogates the principal fault lines in the statutory design. Part VI situates the Indian framework comparatively against the European Union’s General Data Protection Regulation (the “GDPR”), before Part VII proposes calibrated reforms and Part VIII concludes.
From Constitutional Silence to a Fundamental Right
For much of India’s constitutional history, the status of privacy as a fundamental right was genuinely contested. In M.P. Sharma v. Satish Chandra and Kharak Singh v. State of Uttar Pradesh, the Supreme Court declined to recognise privacy as an independent fundamental right, treating it instead as, at best, an incident of personal liberty subject to reasonable restriction. This uncertainty persisted through decades of incremental jurisprudence until a nine-judge Bench, convened specifically to settle the question, unanimously held in Puttaswamy that the right to privacy is intrinsic to the right to life and personal liberty guaranteed under Article 21, and is further entrenched across the freedoms guaranteed under Part III of the Constitution. The Bench expressly overruled the contrary observations in both M.P. Sharma and Kharak Singh.
Puttaswamy did more than declare a right in the abstract; it articulated the doctrinal architecture — legality, necessity, and proportionality — against which any state incursion into informational privacy must be tested. Crucially, the judgment placed an affirmative obligation on the State to enact a carefully structured data protection regime that balances individual autonomy against legitimate state and commercial interests. It is against this constitutional backdrop, and after the withdrawal of the more centralising Personal Data Protection Bill, 2019, that Parliament finally enacted the DPDP Act in August 2023, with the assent of President Droupadi Murmu.
III. The Architecture of the DPDP Act, 2023
Conceptual Framework
The Act applies to the processing of “digital personal data” within India, including data collected offline and subsequently digitised, and extends extraterritorially to processing outside India where connected with profiling or the offering of goods and services to data principals within the country. It deploys a tripartite vocabulary borrowed loosely from the GDPR but renamed for the domestic context: the “Data Fiduciary,” equivalent to a data controller, who determines the purpose and means of processing; the “Data Principal,” the data subject to whom the data relates; and, distinctively, the “Consent Manager,” a registered intermediary through which a data principal may give, manage, review, and withdraw consent across multiple fiduciaries through a single interface. The Consent Manager is a genuinely novel institutional feature without a direct GDPR analogue, intended to address the well-documented problem of fragmented, fiduciary-by-fiduciary consent management.
Consent and the “Certain Legitimate Uses” Carve-Out
The Act anchors lawful processing in consent that is free, specific, informed, unconditional, and unambiguous, accompanied by a clear, itemised notice and a clear affirmative act. A data principal may withdraw consent at any time, with consequences confined to prospective processing. Significantly, however, Section 7 carves out a wide category of “certain legitimate uses” in which processing may proceed without consent altogether — including for purposes of employment, compliance with judgments or orders, medical emergencies, and, most expansively, the performance of any function under law or the provision of services or benefits by the State to a data principal. This carve-out, while administratively convenient and arguably necessary for routine governmental functioning, sits in some tension with the consent-centric model the Act otherwise advertises as its central innovation, since it is left to executive discretion to determine, in practice, how expansively “any function under law” will be read.
Cross-Border Transfers and Children’s Data
Departing from the data-localisation insistence of the 2019 Bill, Section 16 adopts a “negative list,” or blacklist, model: transfer of personal data outside India is permitted by default except to countries that the Central Government specifically restricts by notification. This is a considerably more liberal default than the GDPR’s adequacy-based regime, discussed further in Part VI. For children’s data, Section 9 mandates verifiable parental consent before processing the personal data of a person under eighteen years of age, and prohibits behavioural tracking, targeted advertising directed at children, and any processing likely to cause detrimental effect to a child’s wellbeing, subject to relaxations the Rules may prescribe for specified, lower-risk classes of fiduciaries such as educational and healthcare platforms.
Enforcement: Penalties and the Data Protection Board
Chapter V establishes the Data Protection Board of India (the “Board”) as the principal adjudicatory authority for breaches of the Act. Penalties under the Schedule to the Act are calibrated to the severity of default: up to two hundred and fifty crore rupees for failure to take reasonable security safeguards against a personal data breach; up to two hundred crore rupees for failure to notify the Board and affected data principals of a breach; up to two hundred crore rupees for breach of the heightened obligations concerning children’s data; and a comparatively modest ten thousand rupees for a data principal’s breach of statutory duties. An appeal from an order of the Board lies to the Telecom Disputes Settlement and Appellate Tribunal (“TDSAT”), with a further appeal to the Supreme Court confined to questions of law. The choice of TDSAT — a tribunal constituted to resolve telecommunications and broadcasting disputes — as the appellate forum for data protection matters has attracted criticism on the ground that the tribunal’s existing members may lack specialised expertise in data protection law, even as it is asked to review the Board’s increasingly technical determinations.
The Phased Rollout Under the DPDP Rules, 2025
The Act itself was brought into force only partially upon notification, with substantive compliance obligations deliberately deferred. The Ministry of Electronics and Information Technology notified the DPDP Rules in mid-November 2025, prescribing a three-tier implementation timeline. Provisions establishing the Board’s composition and procedure took effect immediately upon notification; provisions concerning the registration and operation of Consent Managers were deferred to November 2026, twelve months from notification; and the bulk of substantive compliance obligations for data fiduciaries — including breach notification timelines, significant data fiduciary obligations, and verifiable consent mechanisms for children — stand deferred to 13 May 2027, eighteen months from notification. This graduated approach is pragmatic given the scale of compliance required across India’s digital economy, but it also means that, as of mid-2026, India’s flagship data protection statute remains substantially unenforced in practice even as the data flows it is meant to govern have only intensified in the interim.
Critical Fault Lines
Section 17 and the Government Exemption
The most consequential criticism of the DPDP Act concerns Section 17, which empowers the Central Government to exempt any instrumentality of the State from virtually all obligations under the Act — including the consent requirement itself — in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, public order, or the prevention of incitement to any cognisable offence. Unlike the GDPR, which permits member states to restrict data subject rights only through legislative measures that are themselves subject to judicial review and must satisfy an explicit necessity and proportionality test under Article 23, Section 17 vests this exemption power in executive notification, without a mandated sunset clause, without a requirement of prior judicial or parliamentary authorisation, and without a textual proportionality safeguard built into the provision itself. Given India’s documented history of expansive surveillance practice, the absence of an independent oversight mechanism comparable to the proportionality discipline that Puttaswamy itself prescribed is not a minor drafting omission; it sits in direct tension with the judgment that catalysed the statute’s enactment in the first place.
An Adjudicator, Not a Regulator
A second structural weakness lies in the constitution of the Data Protection Board. Unlike data protection authorities in comparable jurisdictions — such as the independent supervisory authorities mandated under Article 51 of the GDPR — the Board is not vested with general rule-making or proactive investigatory powers of its own motion. Its Chairperson and members are appointed by, and serve at terms determined by, the Central Government, and the Act does not entrench a fixed, judicially insulated tenure of the kind that typically protects regulatory appointees from executive pressure. Because the Board’s docket will, in practice, include complaints against government data fiduciaries themselves, this design creates a structural conflict: the body adjudicating the State’s own non-compliance is constituted by, and answerable to, the very executive whose conduct may be in question. A purely adjudicatory, complaint-driven Board, moreover, lacks the proactive auditing and rule-making capacity that would allow it to detect systemic non-compliance before it crystallises into individual harm, in contrast to regulators empowered to conduct own-motion investigations.
Section 44(3): Privacy as a Shield for Opacity
Perhaps the least scrutinised provision at the time of the Bill’s passage, but now the subject of active constitutional litigation, is Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the RTI Act. Prior to the amendment, Section 8(1)(j) exempted “personal information” from disclosure only where it bore no relationship to public activity or interest, or where disclosure would cause unwarranted invasion of privacy — and, crucially, was itself subject to an override permitting disclosure wherever “larger public interest” justified it. Section 44(3) deletes that override and the qualifying language altogether, exempting all information that relates to personal information from disclosure under the RTI Act without any public-interest balancing test. Civil society organisations and several opposition members of Parliament have warned publicly that this amendment will be invoked to deny information central to anti-corruption investigation, social audits of welfare-scheme implementation, and journalistic accountability reporting — precisely the categories of disclosure for which the RTI Act was originally enacted in 2005. The Supreme Court has referred constitutional challenges to Section 44(3) to a five-judge Constitution Bench, but has thus far declined to stay its operation pending final disposal. The episode illustrates a recurring pattern in data protection law globally: provisions framed in the language of protecting the individual can simultaneously function to insulate the State from scrutiny, and the two objectives are not always reconcilable within a single statute.
The Limits of Consent as the Organising Principle
Even on its own consent-centric terms, the Act’s notice-and-consent architecture inherits a well-documented design flaw. Behavioural and legal scholarship on “consent fatigue” has long demonstrated that data subjects tend to accept terms without meaningful engagement when faced with frequent, lengthy disclosures, a phenomenon Professor Daniel Solove has described as the central dilemma of privacy self-management regimes built principally on individual notice and consent. The Act’s reliance on item-by-item notices for an increasingly data-intensive economy risks replicating the GDPR’s own much-criticised “cookie banner” experience rather than improving upon it. The Consent Manager framework is a genuine attempt to address this problem, but its practical utility depends entirely on rules of interoperability between fiduciaries and the rate of voluntary adoption, both of which remain only loosely specified even under the 2025 Rules and are not due for mandatory implementation until November 2026.
A Comparative Perspective: The DPDP Act Against the GDPR
The DPDP Act borrows the GDPR’s basic grammar of lawful basis, purpose limitation, data minimisation, and breach notification, while departing from it in three respects of analytical significance. First, the GDPR recognises six independent legal bases for processing under Article 6(1), including “legitimate interests” balanced against the data subject’s own rights and freedoms, whereas the DPDP Act collapses lawful processing principally into consent and the enumerated “certain legitimate uses” under Section 7 — offering less interpretive flexibility for ordinary commercial processing, but also, in principle, less room for fiduciaries to self-certify routine processing as “legitimate” without external scrutiny. Second, the GDPR’s adequacy-and-derogation model for cross-border transfer requires the European Commission to make an affirmative finding of adequate protection before transfer is permitted, placing the evidentiary burden on demonstrating that a destination is safe; the DPDP Act’s blacklist approach under Section 16 inverts this burden entirely, permitting transfer by default unless and until the government acts to restrict it. Third, and most significant for the purposes of this analysis, the GDPR subjects derogations for national security and public order to the residual scrutiny of the Court of Justice of the European Union and to the general requirement, under Article 23, that restrictions be necessary, proportionate, and provided for by law in a manner that respects the essence of fundamental rights; the DPDP Act’s Section 17 contains no equivalent textual anchor to proportionality, leaving that safeguard to be read in, if at all, only through future judicial interpretation informed by Puttaswamy itself. The comparison suggests that India’s statute is, in its commercial and consumer-facing design, a credible regional peer to the GDPR — arguably more administrable, given the Consent Manager innovation — but, in its treatment of state power, considerably more permissive than its European counterpart.
VII. Recommendations
Three calibrated reforms would address the fault lines identified above without disturbing the Act’s core architecture. First, Section 17 exemptions should be made subject to a mandatory sunset period, mandatory parliamentary tabling, and periodic review of necessity and proportionality by an independent body, mirroring the safeguards that Article 23 of the GDPR already provides for comparable derogations. Second, the appointment and removal of Data Protection Board members should be insulated through a fixed statutory tenure and a broad-based selection committee that includes a sitting or retired judge, consistent with the framework Parliament has used for other statutory tribunals following the Supreme Court’s tribunal-reform jurisprudence. Third, Section 44(3) should be revisited to restore a structured public-interest override, calibrated so that disclosure of personal information remains the exception rather than the rule, but is not foreclosed altogether where it serves a demonstrable anti-corruption or public-accountability function — an outcome the pending constitutional litigation may yet compel even in the absence of legislative initiative.
VIII. Conclusion
The Digital Personal Data Protection Act, 2023 closes a long-standing legislative vacuum and gives statutory texture to the constitutional right recognised in Puttaswamy. Its consent architecture, graded penalty structure, and institutional innovations such as the Consent Manager represent genuine advances over the regulatory void that preceded it for over two decades. Yet a critical reading of the statute — one that looks past its consent-centric public framing to its treatment of state power — reveals that the Act’s principal deficiencies lie not in what it requires of private fiduciaries, but in what it permits the State to exempt itself from, and in how lightly it polices that exemption. As the DPDP Rules move through their phased implementation toward full effect in May 2027, and as the constitutional challenge to Section 44(3) proceeds before a five-judge Constitution Bench, India’s data protection framework remains, in the most accurate sense, unfinished. Whether it ultimately vindicates the proportionality discipline that Puttaswamy demanded of it, or instead entrenches a model in which privacy operates more reliably as a shield for the State than for the citizen, will depend less on the text already enacted than on the rules, enforcement practice, and judicial interpretation still to come.
Reference(S):
Cases
Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
Kharak Singh v. State of Uttar Pradesh, AIR 1963 SC 1295.
M.P. Sharma v. Satish Chandra, AIR 1954 SC 300.
Legislation
Constitution of India, art. 21.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023) (India).
Digital Personal Data Protection Rules, 2025 (notified 22 November 2025) (India).
General Data Protection Regulation (EU) 2016/679 [2016] OJ L119/1, arts. 6, 23, 51.
Right to Information Act, 2005 (No. 22 of 2005) (India), s. 8(1)(j) (as amended by Digital Personal Data Protection Act, 2023, s. 44(3)).
Secondary Sources
B.N. Srikrishna, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (Report of the Committee of Experts, Ministry of Electronics and Information Technology, 2018).
Daniel J. Solove, “Introduction: Privacy Self-Management and the Consent Dilemma” (2013) 126 Harvard Law Review 1880.
Ministry of Electronics and Information Technology, Digital Personal Data Protection Act 2023: An Overview (Government of India, 2023).
Paul M. Schwartz and Karl-Nikolaus Peifer, “Transatlantic Data Privacy Law” (2017) 106 Georgetown Law Journal 115.
