For most of independent India's history, privacy was a legal orphan. It showed up occasionally in tort claims, in scattered criminal-procedure protections and in the margins of property law, but it had no constitutional home. If the police wanted to tap your phone, track your movements or catalogue your habits, the Constitution had surprisingly little to say about it. That changed, decisively and almost unanimously, in 2017. And the way it changed says a great deal about how constitutional rights actually evolve in a democracy: not in a single stroke, but through decades of quiet argument that eventually reaches a tipping point.
A Right Born from a Fingerprint
The irony is that the case which finally gave India a right to privacy did not begin as a privacy case at all. It began with Aadhaar, the government's ambitious project to fingerprint and iris-scan over a billion residents and give each one a unique twelve-digit number. Aadhaar was sold as an efficiency revolution: no more ghost ration cards, no more duplicate welfare claims, a single verifiable identity for every citizen interacting with the state. But as Aadhaar crept from being an optional convenience into a near-mandatory gatekeeper for bank accounts, mobile SIM cards and tax filings, a group of petitioners asked the Supreme Court a question the government's lawyers clearly hoped nobody would ask: does the Constitution even protect your right to keep this information private in the first place?
The government's own answer was startling. Citing two old precedents, M.P. Sharma from 1954 and Kharak Singh from 1962, it argued that privacy was not a fundamental right at all. It was, at best, a common-law nicety that Parliament could grant or withdraw at will.
That argument was serious enough, and the stakes high enough, that the Supreme Court did something it does only for the most foundational constitutional questions: it assembled a nine-judge bench, the largest in decades, to settle the matter once and for all.
Nine Judges, One Answer
In August 2017, in Justice K.S. Puttaswamy (Retd.) v. Union of India, all nine judges agreed: privacy is, and always was, a fundamental right, woven into the right to life and personal liberty under Article 21, and reinforced by the freedoms and equality guarantees found elsewhere in the Constitution. The Court did not just recognise the right; it dismantled the old precedents standing in its way, explicitly overruling both M.P. Sharma and Kharak Singh.
What made the judgment more than a symbolic gesture was its practical architecture. The Court laid down a three-part test that any law infringing privacy must now satisfy: it must be backed by a valid law, it must serve a legitimate state purpose, and, crucially, the means used must be proportionate to that purpose. That third prong, proportionality, is where most of the real legal battles now happen. A surveillance law might tick the first two boxes easily; whether its methods are proportionate to its stated aim is a much harder, more contestable question, and that is exactly the point. The Court built in a permanent friction between state power and individual autonomy, refusing to let either side win by default.
The ruling's fingerprints showed up almost immediately in the follow-up Aadhaar judgment in 2018, where the Court applied this very test, upholding the core Aadhaar architecture for welfare delivery but striking down provisions that let private companies, such as telecom operators and banks, demand Aadhaar authentication for their own commercial convenience.
From Courtroom to Statute Book
A constitutional right is a shield, but it is not a rulebook. It tells you that privacy matters and roughly how much scrutiny a law restricting it must survive; it does not tell a company what consent should look like on a sign-up form, or what happens when a data breach exposes a million customer records. That translation work fell, eventually, to Parliament, six years later, in the form of the Digital Personal Data Protection Act, 2023.
The DPDPA is India's first dedicated data-protection statute, and on paper it borrows heavily from the vocabulary of global privacy law. Individuals become Data Principals with rights to access, correct and erase their personal data. Companies and government bodies that decide how data gets used become Data Fiduciaries, bound to collect only what they need and to notify people when something goes wrong. A new body, the Data Protection Board of India, is meant to police all of this.
It is, in many ways, a genuine leap forward for a country that had never had a comprehensive data-protection framework at all. But it is also a law that critics, including many who cheered the Puttaswamy verdict, view with real unease.
The Exemption That Undermines the Rule
The DPDPA's most contested feature is tucked into Section 17(2)(a), a provision that lets the central government exempt its own agencies from most of the Act's obligations, citing grounds such as sovereignty and integrity of India or security of the state. These are not unusual grounds for restricting rights; national-security exceptions exist in privacy laws worldwide. What troubles critics is the breadth and vagueness of the carve-out, and the absence of any built-in proportionality check specific to how the government itself processes data.
This is where the statute runs headlong into the very judgment that justified its existence. Puttaswamy did not say the state can never intrude on privacy; it said any intrusion must be necessary and proportionate, tested against the actual purpose being served. A blanket exemption clause, by its nature, skips that test rather than passing it. The same tension shows up in the composition of the Data Protection Board itself: its members are appointed by the Executive, which means the very institution meant to check government overreach may lack the independence to do so credibly.
Compare this to the European Union's General Data Protection Regulation, often treated as the global gold standard. The GDPR grants individuals broader rights, including a right to data portability and a general right to object to processing, and vests enforcement in regulators structurally insulated from political interference. The DPDPA's protections, by contrast, are narrower, and its principal enforcer answers, at least administratively, to the government it may need to investigate.
Governance Ambitions, Privacy Costs
None of this happens in a vacuum. India has spent the last decade pursuing an aggressive digital-governance agenda: Aadhaar-linked welfare, digital payments infrastructure, e-governance portals and, increasingly, AI-assisted public services. Each of these initiatives runs on data, and each creates pressure to keep data flowing freely between government departments and, sometimes, private partners. A data-protection law that moves too aggressively against that flow risks friction with the state's own governance ambitions, which may explain, though not necessarily justify, why the exemption clauses are as broad as they are.
This is the genuine dilemma sitting underneath the legal technicalities: privacy and digital governance are not natural enemies, but they do pull in different directions, and a law that tries to serve both without picking a clear hierarchy between them will always look, to someone, like it has picked the wrong side.
What Comes Next
The most likely next chapter is not legislative; it is judicial. Given how directly the DPDPA's exemption provisions seem to test the proportionality standard set out in Puttaswamy, a constitutional challenge feels less like a possibility and more like a matter of time. Legal commentators have already begun referring, half-jokingly, to a coming Puttaswamy III: a case that would ask the Supreme Court to decide whether the exceptions Parliament wrote into the DPDPA can survive the test the Court itself created.
Whichever way that eventually goes, the underlying story is a reminder of something easy to forget in the day-to-day churn of policy debates: rights on paper and rights in practice are two different achievements, separated by years of litigation, legislation and, inevitably, more litigation still. India got its fundamental right to privacy in 2017. Whether it will get a data-protection regime that actually lives up to that right is a question the country is still, quite literally, arguing its way toward.
This article is intended for general informational and educational purposes and does not constitute legal advice.