THE RIGHT TO DIGITAL PRIVACY IN INDIA: A CRITICALANALYSIS OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023

I. Introduction

In August 2017, a nine-judge constitutional bench of the Supreme Court of India unanimously declared the right to privacy a fundamental right under Article 21 of the Constitution. This landmark pronouncement in Justice K.S. Puttaswamy (Retd.) v. Union of India fundamentally altered the constitutional landscape by recognising that personal autonomy and informational self-determination lie at the core of human dignity. Six years later, Parliament responded by enacting the Digital Personal Data Protection Act, 2023 (hereinafter the “DPDP Act”), India’s first standalone data protection legislation.

Yet the passage of this legislation has attracted considerable scholarly debate. Critics argue that the DPDP Act, while progressive in name, is weakened by expansive government exemptions, a structurally compromised regulatory authority, and incomplete rights for data principals. This article critically examines whether the DPDP Act fulfils the constitutional promise of the Puttaswamy ruling, drawing on comparisons with the European Union’s General Data Protection Regulation (GDPR) and evaluating the gaps that remain in India’s privacy framework.

The article proceeds as follows. Part II traces the legal evolution of the right to privacy in India. Part III analyses the key provisions of the DPDP Act. Part IV evaluates the Act’s shortcomings, including its exemption regime and regulatory design. Part V undertakes a comparative analysis with the GDPR. Part VI offers recommendations and concludes with a forward-looking assessment.

II. Legal Evolution of the Right to Privacy in India

A. Pre-Puttaswamy Jurisprudence

For much of independent India’s constitutional history, the right to privacy occupied an uncertain position. In M.P. Sharma v. Satish Chandra (1954), an eight-judge bench held that the Constitution did not protect a right to privacy akin to the Fourth Amendment of the United States Constitution. This position was partially qualified in Kharak Singh v. State of U.P. (1963), where a majority found no independent privacy right, though a minority recognised a limited freedom from state surveillance. Subsequent decisions adopted a more protective stance. In Gobind v. State of M.P. (1975), the Court acknowledged a qualified right to privacy flowing from Articles 19 and 21, while the question of whether it was a fundamental right remained unsettled.

The enactment of the Information Technology Act, 2000 and its 2008 Amendment introduced rudimentary protections for “sensitive personal data or information,” but these provisions were largely inadequate for the age of big data and artificial intelligence. The legislative framework was reactive, insufficiently enforced, and entirely silent on the right of individuals to control their own digital footprint.

B. The Puttaswamy Revolution

The unanimous ruling in Puttaswamy settled the doctrinal ambiguity decisively. Six concurring opinions converged on the proposition that privacy is intrinsic to liberty and dignity under Article 21, and encompasses informational privacy, bodily integrity, and decisional autonomy. Justice D.Y. Chandrachud’s concurrence was particularly emphatic in linking the right to informational privacy with the ability of individuals to control personal data in the digital era. The judgment expressly directed Parliament to establish a “robust data protection regime” consistent with constitutional guarantees.

The constitutional promise of Puttaswamy was reinforced in Shreya Singhal v. Union of India, which struck down Section 66A of the Information Technology Act as unconstitutional, and in Ram Jethmalani v. Union of India, where the Court recognised informational privacy in the context of financial secrecy. Together, these decisions established an expectation that any statutory data protection regime must be constitutionally proportionate, rights-conferring, and independently enforced.

III. The Digital Personal Data Protection Act, 2023: Key Provisions

A. Consent-Based Processing and Rights of Data Principals

The DPDP Act adopts a consent-based model as its foundational architecture. Data fiduciaries — entities that determine the purpose and means of data processing — are required to obtain free, informed, specific, and unconditional consent from data principals before processing personal data. This consent must be accompanied by a notice in clear, plain language describing the purpose of processing. The Act also mandates that fiduciaries implement reasonable security safeguards and adhere to data minimisation and purpose limitation principles.

Data principals are granted a cluster of rights: the right to access information about processing, the right to correction and erasure of personal data, the right to grievance redressal, and the right to nominate a representative in the event of death or incapacity. These rights, while meaningful in principle, are subject to significant caveats. The right to erasure, for instance, does not apply where processing is necessary for compliance with law or for the performance of a legal obligation — a qualification that risks swallowing the right itself in practice.

B. The Data Protection Board and Enforcement Mechanism

The Act establishes a Data Protection Board of India as the adjudicatory authority. The Board is empowered to receive and investigate complaints, impose financial penalties of up to Rs. 250 crore per instance — the ceiling applies to the most serious failures, such as inadequate security safeguards resulting in a personal data breach — and issue binding directions. Because penalties are assessed per violation rather than as a single aggregate cap, a single inquiry that uncovers multiple contraventions can result in cumulative fines well beyond any individual slab. These penalties are non-trivial in scale. However, the institutional design of the Board attracts serious concern: members of the Board are appointed by the Central Government without any express requirement of consultation with the judiciary or an independent selection committee, raising fundamental questions about the separation of powers and regulatory independence.

IV. Critical Evaluation: Gaps and Shortcomings

A. The Government Exemption Regime

The most significant criticism of the DPDP Act concerns its expansive exemption regime. Section 17(2)(a) empowers the Central Government to exempt any instrumentality of the state from all or any provisions of the Act in the interest of “sovereignty and integrity of India,” “security of the State,” “public order,” “prevention of offences,” or “friendly relations with foreign states.” These grounds replicate the language of Articles 19(2) and 19(6) of the Constitution, but without equivalent judicial safeguards or procedural constraints. This blanket exemption effectively removes the State — which is arguably the most significant collector of citizen data — from the scope of the Act’s protections.

The concern is not merely academic. The Government of India processes vast quantities of sensitive personal data through schemes such as Aadhaar and various welfare delivery systems. In Puttaswamy (Aadhaar), the Supreme Court held that informational privacy must be balanced against legitimate state interests through proportionality analysis. Section 17 of the DPDP Act, however, delegates this balancing exercise entirely to the executive, without independent oversight. This structure is inconsistent with the proportionality doctrine mandated by the Court in Puttaswamy and raises the spectre of surveillance without accountability.

B. Structural Vulnerability of the Data Protection Board

A credible data protection authority must be institutionally insulated from the very government entities it is charged with regulating. The independence of such bodies is widely regarded as foundational to effective data governance. Yet the DPDP Act makes the Data Protection Board subject to the control of the Central Government in matters of appointment, tenure, and removal, without any requirement of parliamentary approval or judicial confirmation. The Act further grants the Central Government the power to issue policy directions to the Board, which the Board is obligated to follow.

This design places the Board in a structurally subordinate position to the executive. Comparative experience with regulatory bodies, including the Securities and Exchange Board of India and the Competition Commission of India, demonstrates that genuine independence requires security of tenure, transparent appointment processes, and freedom from ministerial direction on adjudicatory functions. The DPDP Act’s failure to incorporate these safeguards undermines confidence in the Board’s capacity to act as an impartial adjudicator, particularly in complaints against government entities.

C. Incomplete Rights Architecture

The DPDP Act does not recognise the right to data portability — the right of an individual to receive their personal data in a machine-readable format and to transfer it to another data fiduciary. This right, enshrined in Article 20 of the GDPR and regarded as essential to consumer autonomy in digital markets, is entirely absent from the Indian legislation. Its omission is particularly notable given India’s ambitions to develop a data-driven economy and may limit meaningful competition between data fiduciaries.

Similarly, the Act does not establish a right to object to automated decision-making or profiling, leaving individuals without legal recourse when consequential decisions — such as creditworthiness assessments or employment screening — are made by algorithmic systems without human review. As artificial intelligence proliferates across India’s digital economy, this gap becomes increasingly serious.

V. Comparative Analysis: India and the GDPR

A comparison between the DPDP Act and the European Union’s General Data Protection Regulation reveals both points of alignment and significant divergences. Both instruments adopt consent-based processing, mandate purpose limitation, and impose financial penalties for non-compliance. The GDPR, however, provides a substantially more robust rights architecture. It recognises the right to data portability (Article 20), the right to object to automated decision-making (Article 22), and the right to erasure (the “right to be forgotten”) without the sweeping carve-outs present in the DPDP Act.

The GDPR also mandates the establishment of a fully independent supervisory authority in each member state, insulated from government interference, with the power to initiate suo motu investigations and impose administrative fines of up to four percent of annual global turnover, or €20 million, whichever is higher. India’s Data Protection Board, by contrast, operates under executive oversight and is limited to fixed-sum financial penalties that do not scale with corporate revenue. This distinction is significant: for large technology companies, a fixed penalty of Rs. 250 crore may represent an inconsequential cost of doing business, whereas a turnover-based penalty creates a genuinely deterrent sanction.

The California Consumer Privacy Act (CCPA) offers another instructive comparison. The CCPA empowers California residents to opt out of the sale of their personal data and to request its deletion, supported by a private right of action in cases of data breach. The DPDP Act does not provide a comparable private right of action, channelling all remedies through the Board. This limitation may reduce the practical enforcement of individual rights, as access to the Board’s adjudicatory process requires navigating a formal regulatory procedure.

VI. Recommendations and Conclusion

A. Recommendations for Reform

In light of the foregoing analysis, this article advances the following recommendations for legislative and regulatory reform.

First, the government exemption under Section 17 should be narrowed and subjected to judicial oversight. Any exemption from data protection obligations must satisfy the test of proportionality articulated in Puttaswamy: the interference must have a legitimate aim, be necessary, and be proportionate to the objective pursued. A sunset clause requiring periodic parliamentary review of notified exemptions would further mitigate the risk of executive overreach.

Second, the independence of the Data Protection Board must be constitutionally secured. Appointments should be made by a collegium or selection committee that includes judicial members and representatives of civil society, with security of tenure and removal only through a process analogous to that applicable to superior court judges. The Board’s adjudicatory functions must be insulated from executive direction.

Third, Parliament should introduce the right to data portability and the right to object to automated decision-making in a future amendment. These rights are not merely comparative luxuries — in an era of algorithmic governance, they are fundamental to the dignity and autonomy of individuals in digital society.

Fourth, penalties should be restructured on a turnover-based model to ensure effective deterrence against large technology corporations. A fixed-sum ceiling, however substantial in absolute terms, lacks the normative power to alter corporate behaviour when measured against the revenues of global digital platforms operating in India.

B. Conclusion

The Digital Personal Data Protection Act, 2023, represents a meaningful step in India’s long-delayed journey towards comprehensive data protection. It establishes a consent architecture, recognises a core set of individual rights, and creates an adjudicatory mechanism for enforcement. These are achievements that should not be understated in the context of a rapidly digitising economy.

Nevertheless, the Act falls short of the constitutional mandate of Puttaswamy in three critical respects: its overbroad government exemption regime, the structural vulnerability of its regulatory authority, and the incompleteness of its rights framework. These are not peripheral concerns — they go to the heart of whether the Act can deliver meaningful privacy protection or whether it will remain an aspirational document that shields the state from accountability while providing citizens with rights that are difficult to enforce.

The test of India’s commitment to digital privacy will not be found in the text of the statute alone, but in the independence of the institutions it creates, the robustness of the exemptions it refuses to grant, and the seriousness with which it empowers individuals to control their own data. A truly robust data protection framework — one that honours the constitutional promise of Puttaswamy — remains an unfinished project. The DPDP Act is a beginning, but India’s digital future demands more.

Bibliography

A. Primary Sources

i. Legislation

• Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, No. 18, Acts of Parliament, 2016 (India).
• Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).
• General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, OJ L 119/1.
• Information Technology Act, 2000, No. 21, Acts of Parliament, 2000 (India).
• Information Technology (Amendment) Act, 2008, No. 10, Acts of Parliament, 2009 (India).
• Personal Data Protection Bill, 2019, as introduced in the Lok Sabha.
• California Consumer Privacy Act, Cal. Civ. Code § 1798.100 (2018).

ii. Case Law

• Gobind v. State of M.P., (1975) 2 SCC 148.
• Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
• Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar-5J), (2018) 1 SCC 809.
• Kharak Singh v. State of U.P., AIR 1963 SC 1295.
• M.P. Sharma v. Satish Chandra, AIR 1954 SC 300.
• Ram Jethmalani v. Union of India, (2011) 8 SCC 1.
• Shreya Singhal v. Union of India, (2015) 5 SCC 1.

iii. Secondary Sources

• Bhatia G, ‘Privacy, Surveillance and the DPDP Act’ (2024) 59(1) Economic and Political Weekly 22.
• Sengupta A, ‘Independence of Data Protection Authorities: Lessons from the DPDP Act’ (2024) 3 National Law Review 88.
• Uke U, ‘Data Protection Law in India: A Critical Analysis of the Digital Personal Data Protection Act, 2023’ (2024) 5 Indian Journal of Law and Technology 45.
• Narayan N, ‘The Constitutional Right to Privacy and the Quest for Data Protection in India’ (2023) 35 National Law School of India Review 1.
• Raman V, ‘Regulating the Regulators: Institutional Design and Independence of the Data Protection Board’ (2024) 12 Indian Journal of Constitutional Law 67.