The Digital Personal Data Protection Act 2023 has reorganised India’s information rights and welfare-state architecture. With reference to the right-to-privacy Puttaswamy framework, critically analyse.

Introduction:

The Digital Personal Data Protection Act 2023, notified on 11 August 2023, gives statutory effect to the right to informational privacy recognised in K.S. Puttaswamy v. Union of India (2017); it reorganises both information rights and welfare-state data flows through a single consent architecture.

Statutory architecture: Section 4 sets the lawful basis for processing; Section 6 codifies notice and consent; Sections 8-10 enumerate Data Fiduciary duties; Section 11 lists Data Principal rights including access, correction and erasure. Sections 18-26 establish the Data Protection Board of India as adjudicator. Section 7 carves out broad State exemptions for processing 'in public interest'.

Transparency impact: Section 44(3) of the Act amends Section 8(1)(j) of the RTI Act 2005, deleting the proviso that personal information disclosable to Parliament or Legislature could not be denied to citizens — narrowing the public-interest override and chilling RTI applicants seeking civil-servant records.

Constitutional concern: Puttaswamy's three-fold test — legality, necessity, proportionality — requires narrow tailoring. Section 7's blanket State exemptions, the Board's lack of independence (Central Government appointment under Section 19), and absence of regulatory sub-classification mirror the B.N. Srikrishna Committee 2018's warning. The challenge in Internet Freedom Foundation v. Union of India tests these features.

Way forward / Conclusion:

Restore the Section 8(1)(j) RTI proviso, make the Data Protection Board statutorily independent on the SEBI-CCI model, codify a proportionality test for Section 7 exemptions, and notify graded obligations for Significant Data Fiduciaries — reconciling the Act with Puttaswamy's privacy frame.