Data Privacy and Digital Rights Framework in India

India’s data privacy framework combines constitutional protections, cyber-law provisions and dedicated legislation for digital personal data. It seeks to protect individual privacy and digital rights while allowing lawful state and business uses of data, with safeguards against disproportionate interference and surveillance.

Right to Privacy: Constitutional Foundation

In Justice K.S. Puttaswamy (Retd.) v. Union of India, a unanimous nine-judge Supreme Court bench recognised the Right to Privacy as a fundamental right on 24 August 2017. It is intrinsic to the right to life and personal liberty under Article 21, and is also protected through Articles 14 and 19. The Court held that privacy is not absolute. State action that restricts it must satisfy a three-part test:

• Legality: The action must have a basis in law.
• Legitimate aim: It must pursue a valid public purpose, such as national security, public order or crime prevention.
• Proportionality: The measure must be proportionate to its objective.

The judgment overruled the contrary position in M.P. Sharma (1954) and Kharak Singh (1962) and underlined the need for a comprehensive data-protection law. For mains, the central issue is balancing privacy and individual digital rights with legitimate state interests, while ensuring effective safeguards against surveillance.

Information Technology Act, 2000

Before dedicated data-protection legislation, the Information Technology (IT) Act, 2000, provided the principal statutory framework for electronic records, digital signatures and cybercrime. Enacted on 17 October 2000 and amended in 2008, it includes provisions relevant to personal data and confidentiality.

• Section 43A: A body corporate handling sensitive personal data or information (SPDI) must maintain reasonable security practices and procedures. If failure to do so causes wrongful loss or gain, the entity may be liable to pay compensation to the affected person.
• SPDI Rules, 2011: The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules were notified under Section 43A. They define personal information as information capable of identifying a natural person, directly or indirectly.
• SPDI categories: These include passwords, financial information, physical or mental health conditions, sexual orientation, medical records and history, and biometric data.
• Collection safeguards: The Rules require consent for collecting and using SPDI, a privacy policy explaining the purpose and types of information collected, and reasonable security practices.
• Sections 72 and 72A: Section 72 addresses breach of confidentiality and privacy by a person who gains access to information under powers conferred by the Act. Section 72A penalises disclosure of personal information obtained under a lawful contract without consent or in breach of that contract.

Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023, is India’s dedicated legislation for digital personal data. It received Presidential assent on 11 August 2023 and establishes rules for processing such data, seeking to protect individual rights while accommodating legitimate state and business needs.

• Data Principal: The individual to whom the personal data relates.
• Data Fiduciary: A person who determines the purpose and means of processing personal data.
• Data Processor: A person who processes personal data on behalf of a Data Fiduciary.
• Scope: The Act covers processing of digital personal data in India. It also applies to processing outside India when connected with offering goods or services to Data Principals in India.
• Lawful processing: Personal data must be processed for a lawful purpose, with consent as a central basis for processing under the Act.
• Data Principal rights: Individuals can seek information about their data, request correction or erasure, and use a grievance-redressal mechanism.
• Fiduciary duties: Data Fiduciaries must take reasonable security safeguards to prevent personal-data breaches and notify the Data Protection Board and affected Data Principals of a breach without undue delay.
• Significant Data Fiduciaries: Those designated in this category must appoint a Data Protection Officer and undertake data-protection audits and impact assessments.

Under Section 18, the Act establishes the Data Protection Board of India (DPBI) to enforce its provisions. It functions as a digital-first adjudicatory body, receiving complaints, investigating breaches, issuing directions and imposing financial penalties. For certain contraventions, including failure to implement reasonable security safeguards, penalties may extend to INR 250 crore. The DPBI was formally established on 13 November 2025 and operates under the Ministry of Electronics and Information Technology (MeitY). The Justice B.N. Srikrishna Committee, constituted in July 2017, submitted its report and draft Personal Data Protection Bill in July 2018. Its recommendations included a Data Protection Authority, informed consent, data localisation for certain data and accountability measures, including Data Protection Impact Assessments.

Other Related Legal Frameworks

The Telecommunications Act, 2023 received Presidential assent on 24 December 2023 and replaces the Indian Telegraph Act, 1885. It provides a modern regulatory framework for telecommunications and seeks to include Over-The-Top (OTT) services within the definition of telecommunications.

• The Act empowers the Central Government to prescribe cybersecurity standards for telecommunication networks and services, and includes provisions on consumer rights and data privacy.
• For national security or public safety, the government may temporarily take possession of telecommunication services or networks.
• It permits directions for interception or disclosure of messages on grounds including the sovereignty and integrity of India, security of the State and public order. Such powers raise the importance of safeguards for privacy and against disproportionate surveillance.
• The Universal Service Obligation Fund (USOF) was repurposed as the Digital Bharat Nidhi, which supports research and development in the telecom sector.

Key Prelims Takeaways

• Puttaswamy judgment: The 2017 nine-judge ruling recognised privacy as a fundamental right under Articles 21, 14 and 19; restrictions require legality, legitimate aim and proportionality.
• IT Act: Section 43A concerns reasonable security practices for SPDI; Sections 72 and 72A address confidentiality and unauthorised disclosure.
• SPDI Rules, 2011: Cover specified sensitive data and require consent, a privacy policy and reasonable security practices.
• DPDP Act, 2023: Defines Data Principal, Data Fiduciary and Data Processor; applies to qualifying processing in India and abroad.
• DPBI: Established under the DPDP Act in 2025; certain penalties may reach INR 250 crore.
• Srikrishna Committee: Its 2018 recommendations included a Data Protection Authority, informed consent and data localisation for certain data.
• Telecommunications Act: Replaced the Indian Telegraph Act, 1885, and repurposed USOF as Digital Bharat Nidhi.

Recent Context

DoT, under the Ministry of Communications, requires WhatsApp, Telegram, Signal, Arattai, ShareChat, Josh and JioChat to link accounts to live registered SIMs by 31 December 2026 and keep the physical SIM in-device from 1 January 2027; Snapchat is exempt. The measure targets fraud, phishing and digital-arrest scams; six-hour web-session logouts gave way to risk-based logout on 22 October 2026.