Constitutional Foundations

The DPDPA is grounded in the Supreme Court's landmark decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, where a nine-judge bench unanimously recognised the right to privacy as a fundamental right under Article 21 of the Constitution. Privacy has also been described, in subsequent commentary rather than in the judgment itself, as touching a nexus of fundamental rights in Part III, including Articles 14 and 19. The Court held that privacy includes informational privacy - the right to control the dissemination of personal information. This constitutional recognition created the mandate for comprehensive data protection legislation.

The Puttaswamy judgment established that any restriction on the right to privacy must satisfy four tests: (a) Legality - the restriction must be prescribed by law; (b) Legitimate aim - the restriction must pursue a legitimate State objective; (c) Proportionality - the restriction must be proportionate to the aim; and (d) Procedural safeguards - adequate safeguards against abuse must exist. The four-part test was further refined through subsequent rulings, including the Aadhaar judgment and Modern Dental College and Research Centre v. State of Madhya Pradesh, (2016) 7 SCC 353. The DPDPA's provisions - particularly the broad government exemptions under Section 17 - may face scrutiny under this framework.

Article 21 of the Constitution guarantees the right to life and personal liberty. The Puttaswamy judgment expanded this to include privacy as an intrinsic element of life and liberty. The DPDPA operationalises this constitutional right by creating a statutory framework for data protection. It translates the abstract right to privacy into concrete rights (access, correction, erasure) and obligations (consent, security, notification).

Several aspects of the DPDPA are likely to face constitutional challenge: (a) the breadth of Section 17 exemptions for government processing; (b) the adequacy of safeguards against mass surveillance; (c) the proportionality of penalties; and (d) the independence of the Data Protection Board - under the DPDPA, the Central Government appoints the Board members and decides their terms, while in Puttaswamy the Court emphasised that a data protection authority must be independent to be effective against State overreach. The Supreme Court's ongoing engagement with privacy issues ensures that the DPDPA will be interpreted and, if necessary, modified to remain consistent with constitutional principles.