Nine years ago, Puttaswamy recognised privacy as a fundamental right. The Digital Personal Data Protection Act, 2023, was the Indian Parliament’s chance to build the architecture that judgment contemplated. However, the Act falls short when tested against the judgment’s own three-fold test, its institutional expectations, and its dignitarian foundation.

NINE YEARS AGO, a Constitutional Bench comprising nine Judges at the Supreme Court of India revisited a question that had divided Indian constitutional law for over six decades, in Justice K.S. Puttaswamy vs. Union of India, 2017 10 SCC 1 (“Puttaswamy”). That question: whether the right to privacy was protected as a fundamental right under the Constitution of India. The Court held that the right to privacy is an intrinsic part of the right to life and personal liberty under Article 21 and is a fundamental right under the Constitution.

This was an essential exercise, against the backdrop of the unresolved contradiction among judicial precedents on the interpretation of the right to privacy under the Constitution. The Court noted that a comprehensive analysis of precedents was necessary to understand the evolution of how privacy progressed. Importantly, reading the right to privacy under the Constitution was neither the creation of a new right nor a judicial invention.

On 24 August 2026, that anniversary arrives at an odd juncture. Not that the right to privacy is argued into existence, but its first comprehensive legislative vindication, the Digital Personal Data Protection Act, 2023 (“DPDP Act”), is being switched on in phases through the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). 

Not just words: dignity, liberty and privacy

The Court’s emphasis and analysis of the words “Dignity” and “Liberty” in the context of privacy in the Puttaswamy is markedly pertinent. Dignity sits at the very core of fundamental rights under the Constitution, which directly touches on an individual’s life and existence in a manner that even precedes the Constitution as a document. Privacy is one of the values that the protection of life and liberty intends to achieve.

On the reflective note and the accounts of discussion in the judgment on the origins and the critical perspectives of privacy, the Puttaswamy is an exemplary proof that an individual’s interiority is not a gift that the Constitution declines to notice, but a guarantee it protects. Notably, the Constitution, in response to new exigencies, is not limited by its original meaning and interpretation. Interpreting these challenges posed by moving times against existing constitutional understandings requires an expansive reading of liberties and freedoms.

The temptation on an anniversary is to treat the statute as privacy’s fulfilment, the closing of a loop Puttaswamy opened. The more honest reading is narrower and less comfortable: Puttaswamy did not merely declare a right. It built a specific architecture of tests, of institutional demands, and for when that right could be limited. Leaving for the Parliament on how the right to privacy must be realised.

Measured against that architecture, on its own terms, the DPDP Act does not clear the bar its parent judgment set.

The trilogy of cases, reconsidering the foundational doctrinal basis

Today, considering Puttaswamy with seminality and reading the right to privacy as a fundamental right under the Constitution flows from then evaluation of the below three cases and reconsideration of the foundational doctrinal basis, resulting in Puttaswamy overturning  M.P. Sharma vs. Satish Chandra, 1954 1 SCC 385 and Kharak Singh vs. State of U.P., 1962 SCC OnLine SC 10 to the extent them holding the right to privacy is not protected by the Constitution.

Both decisions that had stood since 1954 and 1962, respectively. Doing so was not a technical correction but a repudiation of the jurisprudential premise, inherited from A.K. Gopalan vs. State of Madras, 1950 SCC 228. Gopalan had allowed Article 21 to be read as a residual, thin guarantee walled off from Article 19. 

It is worth pausing on how much doctrinal courage that required. Kharak Singh had upheld domiciliary surveillance while gesturing, incoherently, toward a dignitarian objection it declined to follow through a majority. Puttaswamy called it internally inconsistent, in line with the lone dissent of Justice Subba Rao, who had insisted decades earlier that the right to be let alone was inseparable from personal liberty. 

Gobind vs. State of M.P., (1975) 2 SCC 148 had offered a compromise formula that recognised a privacy interest, but subjected it to a “compelling state interest” test. A test applied so loosely that the regulations before the Court survived anyway. 

Puttaswamy closed that gap. It held that privacy is read into Article 21’s guarantee of life and personal liberty because dignity is the thread connecting them. And a life without the capacity to keep some part of oneself unwatched is not the right to life and personal liberty that Article 21 promises.

The journey of the DPDP Act in brief

Briefly, the DPDP Act arrived after a passage as long as the doctrine itself. Routed through the Information Technology Act, 2000’s (“IT Act”) Section 43A, the A.P. Shah Committee, the Srikrishna Committee’s 2018 report, the withdrawn Personal Data Protection Bill of 2019, and a redrafted bill before Parliament finally passed the Act in August 2023. The DPDP Rules, 2025, notified on 13 November 2025, put the DPDP Act in force in phases. The first stage, commencing on publication of the notification, brings into force the definitions and the provisions establishing and governing the Data Protection Board, among other institutional provisions. The second stage, one year later, brings into operation the provision concerning Consent Managers. The remaining substantive provisions come into force eighteen months after publication, including the notice-and-consent framework, security safeguards, breach intimation, processing of children’s data, Significant Data Fiduciaries, and the provisions governing penalties and other enforcement consequences. Likewise, the DPDP Rules themselves are being brought into force in phases.

That gradualism is defensible as an administration. It is not, however, where the deeper problem lies.

Dignity, substantially missing from the new Indian data protection law “DPDP Act”

It is dignity that the judgment made privacy’s organising value. But it is substantially missing from the DPDP Act, which is meant to operationalise it.

The faults do not sit in sealed boxes; they are the same institutional moves along different fault lines. Puttaswamy’s threshold requirement is legality: a restriction on privacy exist as law, not as executive discretion dressed in statutory language.

The Act does not itself designate which Data Fiduciaries will be Significant Data Fiduciaries, on what terms personal data may cross India’s borders, or what precise standards govern government processing under Section 7(b); these matters are left, in varying degrees, to executive notification or Rules, to be filled in later by the very executive the restriction is meant to constrain. A law that says a rule will decide or leaves the substance of a restriction to executive determination is not, in Puttaswamy’s sense, a law that adequately determines the restriction or, in other terms, places it at the threshold when deciding on privacy.

The same delegation resurfaces that have sharpened into something closer to reproach, once Section 7(b) is read against the litigation that produced this judgment. Section 7(b) permits processing by the State without consent wherever a Data Principal has previously consented to a state benefit, or wherever her data already sits in a government database; this operates as deemed consent, the same executive discretion now exercised over the exact terrain the case arose from.

The petitioners in Puttaswamy were resisting mandatory Aadhaar linkage to numerous welfare schemes and challenging the collection and use of biometric data under the Aadhaar. Section 7(b) does not dismantle that architecture. It gives the State a permanent statutory cover and basis, alongside Section 17(2)(a)’s exemption for specified State instrumentalities on grounds including the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, and preventing incitement to cognizable offences relating to any of these. That exemption is granted with no mandatory impact assessment, no independent authorisation, and no sunset clause. None of this supplies the machinery the three-fold test contemplated to keep a legitimate state aim from hardening into a blank cheque of unchecked administrative discretion.

That is not a hypothetical link. It is like the same file and a related constitutional question, reopened under a new letterhead of statutory framework.

Who adjudicates carries the same design forward

India’s tribunal jurisprudence has repeatedly worried about executive control over appointments, tenure, and removal in bodies meant to adjudicate disputes involving the executive. On the same worrying lines, the Data Protection Board of India, whose Chairperson and Members are to be appointed by the Central Government, and whose terms and conditions of services are prescribed within the executive framework, raises a similar concern about institutional independence, particularly when the Board may be called upon to adjudicate matters involving the State.

A digital office is not an independent one merely for being paperless. An adjudicator whose institutional independence is contestable, as the executive has substantial room to define its framework, creates a problem for a Data Principal whose data has been breached and who seeks to raise a claim. An enforcement mechanism should provide an independent forum.

An individual’s right to compensation

Section 34 directs that all fines by way of penalties imposed by the Data Protection Board be credited to the Consolidated Fund of India, and not to the individual whose data was compromised. The DPDP Act repeals Section 43A of the IT Act in the later phase of its implementation, the provision that had imposed liability on a body corporate to pay compensation for failure to protect certain sensitive personal data or information. The DPDP Act itself does not create a corresponding statutory compensation mechanism under which the penalty imposed by the Board is channelled to the affected Data Principal.

That is not merely a drafting oversight. It is a gap made structural. Puttaswamy grounded privacy in dignity. A penalty paid to the exchequer may punish the wrongdoer, but it is not what dignity requires, which is restoring the person whose privacy was impaired. This distinction matters as the right protected, that is the right to privacy, which forms a part of an individual’s dignity, belongs to the individual. 

It is the duty of the State to protect an Individual’s inalienable fundamental right to privacy and to take measures that vindicate the right, not to enrich the public exchequer through its violation; yet that appears to be the direction of the framework here.

No sensitive data as a category

Bodily, spatial, decisional, and informational privacy, are the different dimensions of privacy, the graded taxonomy that the judgment itself elaborated, collapses, in this scheme that the DPDP Act has formulated, into a single undifferentiated statutory category “personal data.” That means, a leaked medical record and a leaked delivery address may therefore fall as personal data, even though the disclosure of one may carry consequences for dignity and autonomy far more profound than the other. That implies leaving the distinction to the application of law, rather than building into the architecture of protection itself. 

This also leaves the Data Protection Board to determine, on a case-by-case basis, the relative risk and harm associated with different kinds of personal data when assessing a breach and the penalty it should attract. Over time, that may require the Board to develop, through adjudication, an implicit hierarchy of sensitivity and risk that the statute itself has chosen not to articulate.

Travelling away from disclosure

Amending Section 8(1)(j) of the Right to Information Act, 2005 (“RTI”), the DPDP Act removes from that provision the express balancing of personal privacy against public interest that had previously governed disclosure. A protection originally framed to prevent unwarranted invasions of privacy is recast in broader terms, making personal information presumptively harder to obtain even where disclosure may bear upon the public’s ability to scrutinise those who exercise public power. The statutory text no longer expressly preserves the earlier public-interest balancing within clause (j).

Read beside Section 7(b), the pattern is hard to miss. The same statute that widens the State’s licence to process a citizen’s data without asking her narrows the citizen’s licence to know what her State is doing with it.

A right meant to travel from Puttaswamy’s petitioners to India’s data principals has, in that clause, changed direction. It now travels away from disclosure, and toward the State that administers it.

Nine years after nine judges asked the State to justify itself in the language of dignity, this anniversary ought to prompt a harder question than whether India finally has a data protection law. It ought to ask what happens to a right when the institutions meant to give it teeth learn to speak its vocabulary (of reasonable safeguards, proportionate responses and lawful processing) without ever answering to the person that vocabulary was written to protect.

The RTI amendment is not a stray provision; it is the tell. A judgment that strengthened the constitutional space between citizen and State has produced a statute that, in its most quietly consequential clause, narrows that space again for everyone except the State itself.

The Indian data protection story is still being written

While much remains unsaid, on the last note, Puttaswamy was written by a Court that left to future institutions to complete what a single judgment could only begin. That trust was not naïve; it was an invitation. Nine years on, that invitation still stands. The DPDP Act may therefore be understood as a legislative response to Puttaswamy, but whether it amounts to the constitutional fulfilment of the right the judgment recognised remains open to interpretation, implementation and, perhaps, further judicial scrutiny. 

The Indian data protection story is still being written, not only through rules, but through the constitutional courts that may yet be called upon to decide whether the architecture built after Puttaswamy is worthy of the right it was meant to protect.