Introduction
The enactment of digital personal digital personal data protection DPDP act 2023 was hereaided as India’s definitive leap toward securing digital privacy born out of judicial mandate to safeguard citizens in an increasingly digital economy the act increasingly digitized economy the promised to regulate data processing while respecting individual rights however its implementation has triggered an immediate constitution showdown with multiple public ligations challenging its validity before the supreme court petitions argue that under the guise of data protection the stature compromises fundamental democratic tenets this examines the DPDPA Act through a constitutional lens asserting that key provisions fail to satisfy the judicial thresholds of proportionality transparency and separation of power guaranteed under the Indian Constitution
Background
For over two decades Indian lacked a standalone comprehensive data protection law the regulatory ecosystem relied primarily on the information technology IT act 2000 its 2011 information technological rules this fragmented framework proved fundamentally inadequate for handing modern challenges like big data analytics algorithmic profiling and mass surveillance
The definitive turning point occurred in 2017 with the historic nine-judge bench decision in justice [1]K.S PUTTASWAMY v union of India the supreme court unanimously elevated privacy to a fundamental right under article 21explicitly directing the Union government to formulate a robust data protection regime what followed was a tumultuous six-year legislative journey involving th draft bill by the justice [2]B.N SRIKRISHNA committee 2018 multiple iterations of joint parliamentary committee and the abrupt withdrawal of 2019 bill culminating finally in passage of the DPDP act In august 2023
Legal framework
The DPDP act 2023 introduces a streamlined simplified legal architecture compared to its European counterpart the GDPR it established obligation for data fiduciaries entities determining the purpose of data processing and grants statutory rights to data principals the individuals to whom co
The bedrock of this statutory framework is principal of explicit informed consent under section 6 data processing is strictly prohibited unless accompanied by an unambiguous clear notice outlining the specific purpose of data collection to reinforce this framework introduces localized consumer rights notably the right to information regarding processing activities the right to corrections and erasure and an innovative right to nominate a representative in the event of death or medical incapacity conversely the law burdens data fiduciaries with stringent statutory duties including implementing reasonable security safeguard to prevent data breaches and executing mandatory storage limitation protocols once the original processing purpose is fulfilled
However the constitutional challenges pending before the supreme court target several points of friction embedded directly within the text of statute the primary source of legislative conflict is section 44(3) which fundamentally amends section RTI act 2005 by replacing a balanced three part public interest disclosure test with an absolute blank prohibition on releasing any personal information the provision effectively insulates public authorities from democratic scrutiny furthermore section 17(1) grants the executive wide latitude to provide overboard agencies to bypass core consent obligation on open ended grounds like sovereignty and integrity of India or public order lastly the regulatory framework is crippled by structural lack of independence under section 19 the center government retains complete executive control over the composition tenure and appointment of data protection board of India DPBI creating a profound constitutional clash with the doctrine of the separation of power
Constitutional challenges before the supreme court
The statutory anomalies plaguing the [3]DPDP act 2023 have triggered an immediate constitutional showdown with multiple public interest litigations filed by prominent transparency journalist unions and civil rights organization being clubbed for adjudication under article 32 of the constitution of India petitioners contend the act operates as a constitutional regression systematically violating the fundamental guarantees enshrined under [4]articles 14 19(a) AND 21
The primary constitutional challenges before the apex court targets the total dilution of democratic transparency petitioners argue that the absolute bar on disclosing personal data under section 44 (3) directly truncates the right to know a fundamental corollary of free speech under article 19(1) counsel for the petitioners have strongly anchored their arguments in the landmark five-judge bench ruling in [5]central public information officer supreme court of India V. SUBHASH CHANDRA AGARWAL 2019 in that case the supreme court held that personal information held by public authorities could be lawfully disclosed if the larger public interest outweighed the individual’s right to privacy by completely stripping away this public-interest balancing override the DPDP ACT 2023 crates an unconstitutional clash with settled judicial precedents
A parallel equally severe constitutional challenges centers on the overbroad state exemptions institutionalized under section 17 (1) this clause permits government agencies to bypass core consent obligations and process citizens data under loosely defined mandates like sovereignty and integrity of India petitioners argue before the bench that these sweeping executive privileges completely fail the strict three-pronged proportionality test laid down by the historic nine-judge bench decision In justice K.S PUTTASWAMY V. UNION OF INDIA 2017 left unqualified section 17 effectively grants the state unbridled legislative sanction to build a massive digital surveillance apparatus without any independent checks and balances thereby violating the fundamental [6]right to privacy under article 21
Critical evaluation
Critically evaluating the statute reveals that the DPDP ACT 2023 creates a dangerous legal paradox while intending to protect individual privacy its practical application shields state machinery from public accountability while exposing citizens to unchecked surveillance by substituting nuanced balancing test with a blanket prohibition on releasing personal data under the RTI act public authorities routinely exploit this loophole to deny rountine public logs furthermore the data protection board of india is creating a profound breanch of the constitutional doctrine of separation of power
Conclusion
The DPDP act stands at constitutional crossroad for the statute to survive the judicial scrutiny the supreme court must iron out the creases by reading down overboard state exemptions and restoring public interest override of the [7]RTI act only by balancing national security with fundamental freedoms can india achieve a truly robust rights-based digital democracy
Reference
[1] K s puttaswamy v union of india (2012) 10 SCC 1
[2]Manishka seal sakshi nair and zairak Hussain International journal on DPDP in india 19 june 2026
[3] Digital personal data protection act 2023
[4] Digital personal data protection act ss 14 ss 19(a) and 21
[5] Supreme court of India v subhash Chandra Agarwal 2019 16 SCC 407
[6] Constitution of India art 21
[7] Right to information act 2005