Constitutional Status Of Data Protection In India: A Critical Analysis Of The Digital Personal Data Protection Act, 2023
- IJLLR Journal
- Apr 24
- 2 min read
Akshita Singh, Amity Institute of Advanced Legal Studies, Amity University, Noida
ABSTRACT
This paper examines the constitutional status of data protection in India through a critical analysis of the Digital Personal Data Protection Act, 2023 (DPDP Act). The recognition of the right to privacy as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) marked a decisive shift in Indian constitutional jurisprudence, establishing informational privacy as an essential facet of dignity, liberty, and autonomy under Articles 14, 19, and 21. In response, the DPDP Act seeks to provide a statutory framework governing the processing of digital personal data.
The paper traces the evolution of privacy jurisprudence from early judicial resistance in M.P. Sharma v. Satish Chandra (1954) and Kharak Singh v. State of Uttar Pradesh (1963) to its eventual constitutional affirmation. It evaluates whether the DPDP Act successfully translates constitutional principles into an effective regulatory regime. The analysis identifies key structural and normative concerns, including legislative minimalism, excessive executive discretion, expansive state exemptions, dilution of consent through “legitimate uses,” and the limited scope of data principal rights. It also highlights issues relating to the institutional independence of the Data Protection Board, the tension between privacy and transparency following amendments to the Right to Information Act, 2005, and challenges arising from cross-border data flows and algorithmic governance.
The paper argues that while the DPDP Act represents a significant step towards formalising data protection in India, it adopts a predominantly compliance-oriented and executive-driven framework rather than a robust rights-based approach. As a result, it only partially fulfils the constitutional mandate of protecting informational privacy. The study concludes that the effectiveness and constitutional validity of India’s data protection regime will ultimately depend on judicial scrutiny, regulatory interpretation, and future legislative refinement.
Keywords: Data Protection, Right to Privacy, Informational privacy, Digital Personal Data Protection Act, 2023, Constitutional Law, Consent and Legitimate Use, Executive Discretion, Cross- Border Data Transfers.
