Right to Privacy in India — Puttaswamy, Aadhaar, DPDP Act 2023 (UPSC Polity)

The right to privacy in India was conclusively recognised as a Fundamental Right under Article 21 of the Constitution by the Supreme Court's 9-judge Constitution Bench in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). This unanimous ruling overruled two earlier decisions — M.P. Sharma (1954) and Kharak Singh (1962) — and reshaped Indian constitutional law. The judgment is now the doctrinal anchor for debates on Aadhaar, data protection, surveillance, LGBTQ+ rights, and bodily autonomy. For UPSC aspirants, privacy is a recurring theme across Prelims (case facts, tests), GS-II (fundamental rights, judicial review), and Essay (technology and liberty).

Background: the pre-Puttaswamy position

The Constituent Assembly debated inserting a distinct right to privacy and ultimately chose not to include it as a separately enumerated fundamental right. For decades, Indian courts therefore had to derive privacy protections from other guarantees.

• M.P. Sharma v. Satish Chandra (1954) — An 8-judge bench held that there was no right to privacy in the Constitution, contrasting the absence of a Fourth Amendment-style clause.
• Kharak Singh v. State of UP (1962) — A 6-judge bench similarly held there was no standalone privacy right, although domiciliary night visits were struck down on Article 21 grounds.
• Maneka Gandhi v. Union of India (1978) — A watershed ruling: any law restricting personal liberty must be "just, fair and reasonable", widening Article 21 jurisprudence.
• Gobind v. State of MP (1975), R. Rajagopal (1994), PUCL v. Union of India (1997) — smaller benches recognised privacy incidents (phone tapping, publication, surveillance), but could not overrule the larger earlier benches.

By the 2010s, the Aadhaar programme forced a definitive ruling. In Justice K.S. Puttaswamy v. Union of India, the petitioner, a retired Karnataka High Court judge, challenged Aadhaar biometric collection as a violation of privacy. The Attorney General argued that privacy was never a fundamental right — compelling the reference to a 9-judge Constitution Bench.

The Puttaswamy verdict (24 August 2017)

All nine judges concurred. Six separate opinions were written, all arriving at the same conclusions.

1. Privacy is a Fundamental Right

Privacy is intrinsic to life and personal liberty under Article 21 and also inheres in the freedoms under Article 19 and the equality guarantee under Article 14. It is not a derivative or common-law right — it has full constitutional status.

2. Older precedents overruled

The bench expressly overruled M.P. Sharma (1954) and the privacy portion of Kharak Singh (1962).

3. Privacy has multiple dimensions

The judgment identified privacy as encompassing:

• Bodily privacy — physical integrity, freedom from unwanted intrusion.
• Informational privacy — control over personal data.
• Decisional/mental privacy — autonomy over personal choices (food, dress, faith, sexuality).
• Spatial privacy — home, personal communications.

4. The three-fold proportionality test

Privacy is not absolute. State intrusion is permitted only if it satisfies three cumulative requirements:

5. Identity, dignity and sexual orientation

Justice D.Y. Chandrachud's opinion held that sexual orientation is an essential component of identity and therefore protected by privacy. This directly enabled Navtej Singh Johar v. Union of India (2018), which read down Section 377 IPC to decriminalise consensual same-sex relations.

6. Consequential rights

The court implicitly recognised a right to be forgotten, autonomy in reproductive choices, and protection against state surveillance — doctrines that have since been elaborated by high courts and future benches.

Cases that followed Puttaswamy

Puttaswamy became the constitutional bedrock for a cluster of rights-expanding rulings:

• Navtej Singh Johar v. UoI (2018) — Section 377 partially struck down; consensual same-sex acts decriminalised.
• Joseph Shine v. UoI (2018) — Section 497 IPC (adultery) struck down; held to violate autonomy, dignity and privacy of women.
• Indian Young Lawyers Assn. v. State of Kerala (2018) — Women of all ages permitted entry to Sabarimala Temple; forced disclosure of menstrual status violates privacy and dignity (though review is pending before a 9-judge bench on religious-freedom questions).
• Justice K.S. Puttaswamy v. UoI (Aadhaar, 2018) — Aadhaar upheld with significant modifications (see below).

The Aadhaar judgment (2018)

A 5-judge Constitution Bench (3:2 majority) upheld the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 with major limitations.

Upheld: Aadhaar for welfare subsidies under Article 21 (entitlements as rights); linkage to income-tax returns; core Aadhaar architecture.

Struck down: Section 57 (use by private entities like banks and telecom companies); mandatory Aadhaar for SIMs and school enrolment; mandatory linkage to bank accounts.

Justice D.Y. Chandrachud's dissent argued the Aadhaar Act was wrongly passed as a Money Bill (bypassing Rajya Sabha) — a "fraud on the Constitution" — and that authentication logs enable a 360-degree surveillance profile. When he later became CJI, his privacy jurisprudence shaped the court's direction.

Digital Personal Data Protection Act, 2023

Six years after Puttaswamy, Parliament enacted the Digital Personal Data Protection Act, 2023 (DPDP Act) — India's first comprehensive data-protection statute.

Criticisms: broad executive exemptions, absence of mandatory data localisation, weaker penalties than the EU GDPR, limited user rights (no data-portability right), and an amendment to Section 8(1)(j) of the RTI Act, 2005 that makes it easier to withhold personal information from citizens — widely viewed as eroding transparency.

Latest developments (2024-26)

Updated context: The DPDP Act's detailed Rules were released in draft in early 2025 and are being finalised, with staggered notification of provisions expected through 2025-26. The Data Protection Board's composition, appeals mechanism, and sandbox provisions remain under active rule-making.

• Deletion timelines and consent managers: Draft rules operationalise consent-manager registration and data-erasure windows for e-commerce, social media and health platforms.
• Puttaswamy-II surveillance challenge: Petitions challenging the Telecommunications Act, 2023 and the Broadcasting Services (Regulation) Bill on surveillance and content-monitoring grounds invoke the proportionality test.
• Pegasus matter: The Supreme Court's technical committee report (submitted 2022) and subsequent petitions continue to raise concerns about targeted surveillance and legality under the Telegraph Act, 1885 and the new Telecommunications Act.
• Right to be forgotten in high courts: Delhi, Karnataka and Madras High Courts have progressively recognised the right to de-indexing in specific factual contexts.
• Facial recognition and CCTNS: NHRC and civil-society petitions have highlighted the absence of enabling legislation, raising fresh legality-prong questions.

Analysis: tensions and unresolved questions

1. State vs. individual — Broad national-security exemptions in DPDP Act may not survive the proportionality test if challenged.
2. Platform power — The Act focuses on state-individual and fiduciary-individual relations, but gives limited leverage to users against Big Tech monopolies.
3. Federalism — Privacy enforcement is centralised via the Data Protection Board, with limited state role.
4. Dignity jurisprudence — Privacy now anchors decisions on reproductive autonomy, euthanasia (Common Cause v. UoI, 2018 on passive euthanasia), and same-sex marriage (Supriyo v. UoI, 2023 recognised the dignity interest even though marriage equality was denied).
5. Technology outpacing law — Deepfakes, AI profiling and biometric surveillance remain inadequately regulated.

UPSC Relevance

GS-II mapping: Fundamental Rights; Role of judiciary; Important aspects of governance; Government policies; Statutory bodies (Data Protection Board).

Prelims pointers:

• Puttaswamy verdict date: 24 August 2017; 9-judge unanimous bench.
• Cases overruled: M.P. Sharma (1954) and Kharak Singh (1962) (privacy portion).
• Three-fold test: legality, legitimate aim, proportionality.
• Privacy anchored in Articles 14, 19 and 21.
• Aadhaar verdict (2018): 5-judge, 3:2; Section 57 struck down.
• DPDP Act, 2023 — first comprehensive data law; establishes the Data Protection Board of India.
• Navtej Johar (2018) drew directly from Puttaswamy on sexual orientation and identity.

Mains angles:

• "Privacy is the ultimate expression of the sanctity of the individual." Discuss in the context of the Puttaswamy verdict and the DPDP Act, 2023.
• Examine the adequacy of India's data-protection framework against the proportionality test laid down in Puttaswamy.

Related: Fundamental Rights in India, Article 21, Judicial Activism.