Legal Narrative
ABSTRACT
In Puttaswamy, the Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution of India and required every intrusion to satisfy legality, a legitimate aim, and proportionality.1 This article examines how that promise has fared in three areas: state surveillance, the Aadhaar identity project, and the Digital Personal Data Protection Act, 2023.2 It argues that judicial review has trimmed the most intrusive features of Aadhaar, but that surveillance law remains largely untested against the proportionality standard. The 2023 Act creates a consent-based regime for private actors, yet its broad exemptions for the State dilute the constitutional guarantee. The article closes with reforms intended to align statutory design with the standard the Court set.
CHAPTER I
INTRODUCTION
In 2017, a nine-judge bench unanimously held that privacy is a fundamental right protected by Article 21.3 The judgment was expected to reshape how the State collects, stores, and uses personal information. Since then the Court has upheld the Aadhaar scheme with modifications,4 and Parliament has enacted a general data-protection statute.5 Nearly a decade on, the gap between constitutional principle and statutory practice is the central question. This article assesses that gap through surveillance, Aadhaar, and the 2023 Act, and asks whether the proportionality standard has genuinely disciplined state power. Chapter II traces the doctrinal foundations of the right. Chapters III and IV examine surveillance and Aadhaar, where the State’s informational power is most visible. Chapter V evaluates the 2023 Act, and Chapter VI offers conclusions and suggestions. The central claim is that constitutional review has worked best where a specific scheme is challenged, and least where the challenge is to an entire statutory architecture.
CHAPTER II
DOCTRINAL FOUNDATIONS
A. The Early Denial of Privacy
For decades the Court treated privacy as constitutionally doubtful. M.P. Sharma rejected a privacy right against search and seizure,6 and Kharak Singh refused to read one into Article 21, though it struck down night-time domiciliary visits.7 Justice Subba Rao’s dissent in Kharak Singh kept the idea alive.8 Gobind later accepted a limited privacy right, subject to a compelling state interest.9 The intellectual roots of the right lie in the broader argument for a “right to be let alone.”10
B. The Nine-Judge Bench and Proportionality
Puttaswamy I overruled M.P. Sharma and Kharak Singh to the extent they denied privacy protection.11 It grounded the right in dignity, autonomy, and liberty. Justice Chandrachud’s opinion set out a three-part test for state intrusion: a law authorising it (legality), a legitimate state aim, and a rational and proportionate relationship between the means and that aim.12 This test now governs every dispute discussed below. Its reach extends to informational privacy, which is the core of data protection. The Aadhaar judgment later gave the test a more structured form, asking whether a measure pursues a legitimate goal, is suitable to achieve it, is necessary because no less intrusive alternative exists, and strikes a fair balance between the right and the goal.13 The necessity limb matters most in practice, because it forces the State to explain why a less invasive design would not work.
CHAPTER III
SURVEILLANCE AFTER PUTTASWAMY
A. The Statutory Architecture
India’s interception regime predates Puttaswamy and has been only marginally reformed. Interception was historically authorised under section 5(2) of the Telegraph Act and section 69 of the Information Technology Act, together with the 2009 Interception Rules.14 The Telecommunications Act, 2023 now carries the power forward in section 20.15 These provisions rely on executive authorisation, typically by the Home Secretary, rather than prior judicial approval.16 The Court in PUCL laid down procedural safeguards, but these remain internal to the executive.17 Review, too, is confined to a committee of senior officials, which examines orders issued by the executive itself.18 Interception orders are confidential, so the person targeted rarely learns of the intrusion and cannot challenge it.19 A right that cannot be asserted because its violation is invisible is weakly protected, whatever the doctrine says.
B. Judicial Responses
Courts have been cautious. In the Pegasus litigation, the Court declined to accept a bare invocation of national security and appointed an expert committee to examine the allegations.20 It observed that the State does not get a “free pass” merely by citing security.21 That was a procedural check, not a substantive ruling on the legality of spyware. In Anuradha Bhasin, the Court applied proportionality to indefinite internet shutdowns and required that restrictions be published and reviewable.22 These decisions show proportionality operating at the margins. Yet the core interception framework has not been directly struck down or rewritten in light of Puttaswamy. In Solove’s terms, the harms here include aggregation and surveillance itself, not only disclosure.23
CHAPTER IV
AADHAAR AND THE LIMITS OF PROPORTIONALITY A. The Aadhaar Judgment
The Aadhaar Act, 2016 created a biometric identity system, initially passed as a Money Bill.24 In 2018, a 4:1 majority upheld the Act’s core, allowing Aadhaar for welfare subsidies, but read down or struck several provisions.25 It invalidated section 57, which permitted private use of Aadhaar, and section 33(2), which allowed disclosure on national-security grounds without adequate safeguards.26 It also barred mandatory linking for bank accounts and mobile connections, and limited the retention of authentication data.27 Justice Chandrachud dissented, holding that the Money Bill route was a fraud on the Constitution and that the scheme failed proportionality.28 The majority, by contrast, reasoned that the scheme collected limited demographic and biometric data, did not record the purpose of each authentication, and served the legitimate aim of targeting welfare benefits.29 The disagreement is instructive: both opinions applied proportionality, yet they reached opposite conclusions because they weighed the same features, such as centralised storage and the risk of exclusion, very differently.
B. Continuing Concerns
The private-sector use struck down in 2018 was partly revived through the 2019 amendments, which permit voluntary authentication by entities under specified conditions.30 The judgment therefore shows a pattern: the Court confines the State’s most invasive uses without dismantling the architecture. Concerns about exclusion from welfare due to authentication failure, centralised data risks, and function creep persist.31 Aadhaar tests whether proportionality can restrain an entrenched system after the fact.
CHAPTER V
THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 A. The Framework
The DPDP Act finally provides a general data-protection statute, following the Srikrishna Committee’s blueprint, the withdrawn 2019 Bill, and a 2021 parliamentary committee report.32 Earlier, protection rested mainly on sections 43A and 72A of the Information Technology Act.33 The DPDP Act builds on notice and consent, purpose limitation, data-principal rights (access, correction, erasure, and grievance redressal), and duties for data fiduciaries.34 It also imposes heightened obligations for children’s data.35 It is not a complete regime, however: the data portability and wider “right to be forgotten” proposed in 2018 did not survive, and the Act offers only correction and erasure.36
B. State Exemptions and Legitimate Uses
The Act’s weakness lies in its treatment of the State. Section 7 permits processing without consent for a range of “legitimate uses,” including state functions, subsidies, and benefits.37 Section 17(2)(a) allows the Central Government to exempt any state instrumentality from the Act’s requirements in the interests of sovereignty, security, or public order.38 Section 36 lets the Central Government call for information from any fiduciary or intermediary.39 Exemption by executive notification, without statutory criteria for necessity or proportionality, sits uneasily with the legality and proportionality requirements of Puttaswamy.40 Where a state body processes data as a “legitimate use,” the consent-based safeguards that anchor the Act simply do not apply. The individual is left with a narrow set of rights against the very entity most capable of harming her. The Act also gives data principals no right to compensation for breaches.41
C. The RTI Amendment and Institutional Independence
Section 44(3) amends the Right to Information Act, 2005 so that section 8(1)(j) exempts all “personal information” from disclosure, without the earlier public-interest balancing.42 Critics fear this will weaken transparency and accountability. Separately, the Data Protection Board is appointed by the Central Government, which also frames its terms of service.43 A regulator dependent on the executive is poorly placed to police the State as a data fiduciary. The European Union’s approach differs, requiring supervisory authorities to act with complete independence.44 Implementation is also incomplete. In November 2025 the Government notified the final Digital Personal Data Protection Rules, 2025 and brought the Board into being, but deferred sections 3 to 17, including the State exemptions, by eighteen months.45
CHAPTER VI
CONCLUSION AND SUGGESTIONS
Puttaswamy changed constitutional language but only partly changed statutory practice. Aadhaar shows that courts can narrow intrusive schemes, surveillance law remains largely insulated, and the DPDP Act regulates private actors more rigorously than the State. The lesson is not that proportionality has failed, but that it has been applied case by case while the underlying statutes remain untouched. Three reforms are recommended.
1. Judicial or independent oversight of surveillance. Prior authorisation by a judicial or independent body should replace executive-only approval, with periodic parliamentary review and notification to affected persons after the fact.46
2. Narrow the State exemptions. Section 17(2)(a) should require reasoned, time bound, publicly reviewable notifications, tested against necessity and proportionality.47
3. Restore RTI balance and regulatory independence. Section 8(1)(j) should be restored to its public-interest balancing form. The Board should have an independent appointment process, and data principals should have a right to compensation.48
Privacy protections will be effective only when the State is held to the same standard as private actors. Bringing the DPDP Act and surveillance law into line with proportionality is the unfinished work of Puttaswamy.
FOOTNOTES
1 India Const. art. 21; Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1, ¶¶ 180, 652 (India) (opinion of Chandrachud, J.) [hereinafter Puttaswamy I].
2 Digital Personal Data Protection Act, 2023, No. 22 of 2023, India Code (2023) [hereinafter DPDP Act]; Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, No. 18 of 2016, India Code (2016) [hereinafter Aadhaar Act].
3Puttaswamy I, (2017) 10 S.C.C. 1, ¶ 652 (opinion of Chandrachud, J.); India Const. art. 21.
4Justice K.S. Puttaswamy (Retd.) v. Union of India, (2019) 1 S.C.C. 1 (India) [hereinafter Aadhaar Judgment].
5See generally DPDP Act.
6 M.P. Sharma v. Satish Chandra, A.I.R. 1954 S.C. 300 (India).
7 Kharak Singh v. State of Uttar Pradesh, A.I.R. 1963 S.C. 1295 (India).
8Id. (Subba Rao, J., dissenting).
9 Gobind v. State of Madhya Pradesh, (1975) 2 S.C.C. 148 (India).
10 Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193, 195 (1890).
11 Puttaswamy I, (2017) 10 S.C.C. 1, ¶ 652 (opinion of Chandrachud, J.) (overruling M.P. Sharma, A.I.R. 1954 S.C. 300, and Kharak Singh, A.I.R. 1963 S.C. 1295, to that extent).
12 Puttaswamy I, (2017) 10 S.C.C. 1, ¶ 180 (opinion of Chandrachud, J.).
13 Aadhaar Judgment, (2019) 1 S.C.C. 1 (opinion of Sikri, J.).
14 Indian Telegraph Act, 1885, No. 13 of 1885, § 5(2), India Code (1885); Information Technology Act, 2000, No. 21 of 2000, § 69, India Code (2000) [hereinafter IT Act]; Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, G.S.R. 780(E) (Oct. 27, 2009) (India) [hereinafter Interception Rules].
15 Telecommunications Act, 2023, No. 44 of 2023, § 20, India Code (2023).
16 Interception Rules rr. 2(d), 3; Indian Telegraph Rules, 1951, r. 419A (India).
17 People’s Union for Civil Liberties v. Union of India, (1997) 1 S.C.C. 301 (India).
18 Interception Rules r. 22; Indian Telegraph Rules, 1951, r. 419A.
19 See generally Interception Rules.
20 Manohar Lal Sharma v. Union of India, W.P. (Crim.) No. 314 of 2021 (India Oct. 27, 2021).
21 Id.
22 Anuradha Bhasin v. Union of India, (2020) 3 S.C.C. 637 (India).
23 Daniel J. Solove, A Taxonomy of Privacy, 154 U. PA. L. REV. 477 (2006). 24 See Aadhaar Act; India Const. art. 110.
25 Aadhaar Judgment, (2019) 1 S.C.C. 1 (opinion of Sikri, J., for himself, Misra, C.J.I., and Khanwilkar, J.; Bhushan, J., concurring; Chandrachud, J., dissenting).
26 Id. (invalidating Aadhaar Act §§ 33(2) and 57).
27 Id.
28 Id. (opinion of Chandrachud, J., dissenting).
29 Id. (opinion of Sikri, J.).
30 Aadhaar and Other Laws (Amendment) Act, 2019, No. 14 of 2019, India Code (2019).
31 See Aadhaar Judgment, (2019) 1 S.C.C. 1 (opinion of Chandrachud, J., dissenting).
32 Comm. of Experts under the Chairmanship of Justice B.N. Srikrishna, Ministry of Elec. & Info. Tech., A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (2018) (India) [hereinafter Srikrishna Report]; Personal Data Protection Bill, 2019, Bill No. 373 of 2019 (India) (withdrawn Aug. 3, 2022); Joint Comm. on the Pers. Data Prot. Bill, 2019, Report of the Joint Committee on the Personal Data Protection Bill, 2019 (17th Lok Sabha, Dec. 2021) (India).
33 IT Act §§ 43A, 72A.
34 DPDP Act §§ 4–6, 8, 11–14.
35 DPDP Act § 9.
36 Compare Srikrishna Report, supra note 32 (draft Personal Data Protection Bill, 2018, cls. 26–27 (data portability and right to be forgotten)), with DPDP Act § 12 (correction and erasure).
37 DPDP Act § 7.
38 DPDP Act § 17(2)(a).
39 DPDP Act § 36.
40 See Puttaswamy I, (2017) 10 S.C.C. 1, ¶ 180 (opinion of Chandrachud, J.). 41 See DPDP Act §§ 33–34.
42 DPDP Act § 44(3); Right to Information Act, 2005, No. 22 of 2005, § 8(1)(j), India Code (2005).
43 DPDP Act §§ 18–20.
44 Regulation 2016/679, of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), art. 52(1), 2016 O.J. (L 119) 1.
45 Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, Extraordinary, pt. II, § 3(i) (Nov. 13, 2025) (India); Ministry of Elec. & Info. Tech., Notification No. G.S.R. 843(E) (Nov. 13, 2025) (appointing commencement dates under DPDP Act § 1(2)).
46 See Telecommunications Act § 20; Interception Rules r. 22.
47 See DPDP Act § 17(2)(a); Puttaswamy I, (2017) 10 S.C.C. 1, ¶ 180 (opinion of Chandrachud, J.).
48 See Right to Information Act, 2005, § 8(1)(j) (as it stood before DPDP Act § 44(3)); DPDP Act §§ 19, 33–34.
REFERENCES
Cases
1. Anuradha Bhasin v. Union of India, (2020) 3 S.C.C. 637 (India). 2. Gobind v. State of Madhya Pradesh, (1975) 2 S.C.C. 148 (India).
3. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India).
4. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2019) 1 S.C.C. 1 (India) (Aadhaar).
5. Kharak Singh v. State of Uttar Pradesh, A.I.R. 1963 S.C. 1295 (India).
6. Manohar Lal Sharma v. Union of India, W.P. (Crim.) No. 314 of 2021 (India Oct. 27, 2021).
7. M.P. Sharma v. Satish Chandra, A.I.R. 1954 S.C. 300 (India).
8. People’s Union for Civil Liberties v. Union of India, (1997) 1 S.C.C. 301 (India).
Constitutional Provisions and Statutes
9. India Const. arts. 21, 110.
10. Aadhaar and Other Laws (Amendment) Act, 2019, No. 14 of 2019, India Code (2019).
11. Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, No. 18 of 2016, India Code (2016).
12. Digital Personal Data Protection Act, 2023, No. 22 of 2023, India Code (2023).
13. Indian Telegraph Act, 1885, No. 13 of 1885, India Code (1885). 14. Information Technology Act, 2000, No. 21 of 2000, India Code (2000). 15. Right to Information Act, 2005, No. 22 of 2005, India Code (2005). 16. Telecommunications Act, 2023, No. 44 of 2023, India Code (2023).
Rules, Notifications and Bills
17. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, Extraordinary, pt. II, § 3(i) (Nov. 13, 2025) (India).
18. Indian Telegraph Rules, 1951, r. 419A (India).
19. Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, G.S.R. 780(E) (Oct. 27, 2009) (India).
20. Ministry of Elec. & Info. Tech., Notification No. G.S.R. 843(E) (Nov. 13, 2025) (appointing commencement dates under Digital Personal Data Protection Act, 2023, § 1(2)).
21. Personal Data Protection Bill, 2018 (draft) (India).
22. Personal Data Protection Bill, 2019, Bill No. 373 of 2019 (India).
Reports
23. Comm. of Experts under the Chairmanship of Justice B.N. Srikrishna, Ministry of Elec. & Info. Tech., A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (2018) (India).
24. Joint Comm. on the Pers. Data Prot. Bill, 2019, Report of the Joint Committee on the Personal Data Protection Bill, 2019 (17th Lok Sabha, Dec. 2021) (India).
Articles
25. Daniel J. Solove, A Taxonomy of Privacy, 154 U. PA. L. REV. 477 (2006).
26. Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193 (1890).
International Materials
27. Regulation 2016/679, of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 1.
