Data protection and privacy

1. Privacy as a fundamental right

In Justice K.S. Puttaswamy (Retd.) v. Union of India, 2017 INSC 801 (24 August 2017), a nine-judge bench unanimously held that the right to privacy is a fundamental right, protected as an intrinsic part of the right to life and personal liberty under Article 21 and as part of the freedoms in Part III. It overruled M.P. Sharma (1954) and Kharak Singh (1962) to the extent they held otherwise. Privacy includes informational privacy. Any invasion must satisfy the tests of legality (a law), legitimate aim and proportionality. The Court noted the Government’s move to frame a data protection regime; the DPDP Act is the result.

2. The IT Act provisions

As enacted, section 72 carried imprisonment up to two years and section 72A up to three years. The Jan Vishwas (Amendment of Provisions) Act, 2023 replaced these with monetary penalties of up to five lakh rupees (section 72) and twenty-five lakh rupees (section 72A).

SPDI Rules, 2011. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 list what counts as sensitive personal data (passwords, financial information such as bank and card details, physical, physiological and mental health, sexual orientation, medical records and history, and biometric information), require a privacy policy and consent for collection, limit disclosure, and treat the IS/ISO/IEC 27001 standard (or an approved code) as reasonable security practice.

3. DPDP Act, 2023: scheme

• Application (s.3). Digital personal data processed in India, whether collected in digital form or digitised later; and processing outside India if connected with offering goods or services to Data Principals in India. It does not apply to data processed by an individual for personal or domestic purposes, or to data made publicly available by the Data Principal herself or under a legal duty.
• Key definitions (s.2). Data Principal: the individual to whom the data relates (for a child, includes the parent or lawful guardian). Data Fiduciary: the person who determines the purpose and means of processing. Data Processor: one who processes on behalf of a Fiduciary. Child: under eighteen years. Personal data: data about an identifiable individual. Consent Manager: a person registered with the Board who lets a Data Principal give, manage, review and withdraw consent.
• Grounds (s.4). Personal data may be processed only for a lawful purpose, on consent or for certain legitimate uses. A notice must accompany or precede a request for consent (s.5).
• Consent (s.6). Must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to data necessary for the purpose. It may be withdrawn at any time, as easily as it was given (s.6(4)). It may be given or withdrawn through a Consent Manager (s.6(7)), who must be registered with the Board (s.6(9)). In a dispute, the Fiduciary must prove that notice was given and consent obtained (s.6(10)).
• Legitimate uses (s.7). Processing without fresh consent where the Data Principal voluntarily provided data for a specified purpose and has not objected; State subsidies, benefits and licences; performance of State functions; compliance with law or judgments; medical emergencies; epidemics; disasters; and employment purposes.
• Obligations of the Data Fiduciary (s.8). Responsible even for processing by its Processor; ensure accuracy where data is used for decisions; take reasonable security safeguards to prevent breach (s.8(5)); intimate every personal data breach to the Board and each affected Data Principal (s.8(6)); erase data when consent is withdrawn or the purpose is served (s.8(7)); publish contact details (s.8(9)); set up grievance redressal (s.8(10)).
• Children (s.9). Verifiable consent of the parent (or lawful guardian of a person with disability) before processing; no processing likely to harm the child’s well-being; no tracking, behavioural monitoring or targeted advertising directed at children. Exemptions may be prescribed (s.9(4)).
• Significant Data Fiduciary (s.10). Notified by the Central Government on factors such as volume and sensitivity of data, risk to rights, sovereignty, electoral democracy, security and public order. Must appoint a Data Protection Officer based in India, an independent data auditor, and carry out periodic Data Protection Impact Assessments.
• Rights (ss.11-14). Access to information about processing (s.11); correction, completion, updating and erasure (s.12); grievance redressal (s.13); nomination of another person to act on death or incapacity (s.14).
• Duties (s.15). Comply with law, not impersonate, not suppress material information, not file false or frivolous complaints, give only authentic information. Breach: penalty up to ten thousand rupees.
• Cross-border transfer (s.16). A negative list: the Central Government may by notification restrict transfer to notified countries. Sector laws giving higher protection still apply.
• Exemptions (s.17). Most obligations do not apply to processing for enforcing legal rights, by courts and tribunals, for prevention and investigation of offences, for approved mergers, and for tracing loan defaulters. Under s.17(2) the Central Government may exempt notified State instrumentalities (sovereignty, security, public order) and processing for research, archiving or statistics.

4. Board, appeal and penalties

• Data Protection Board of India (s.18), established by G.S.R. 844(E) on 13 November 2025 with its head office in the National Capital Region. It works as a digital office (s.28), inquires into breaches and imposes penalties (s.27, s.33). Civil courts are barred (s.39).
• Appeal lies to the Appellate Tribunal, which is the TDSAT, within sixty days (s.29).
• Blocking: on the Board’s reference after penalties in two or more instances, the Central Government may block access to a Fiduciary’s platform (s.37).

5. Amendments to other laws (s.44)

• s.44(1): TRAI Act amended so that TDSAT is also the Appellate Tribunal under the DPDP Act.
• s.44(2): IT Act amended: section 43A omitted, and the section 81 proviso extended to the DPDP Act.
• s.44(3): section 8(1)(j) of the RTI Act substituted to read simply “information which relates to personal information”, removing the earlier larger-public-interest override in that clause.

6. Commencement and the DPDP Rules, 2025

The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) on the same day. Rules 1, 2 and 17 to 21 (the Board) came into force at once; rule 4 (consent managers) after one year; rules 3, 5 to 16, 22 and 23 after eighteen months. Among other things, the Rules require a Fiduciary to report a breach to the Board without delay and give a detailed report within seventy-two hours of becoming aware of it.

How AIBE asks this

Expect questions on the bench and holding of Puttaswamy (nine judges, Article 21), the section that gives compensation for failure to protect data (43A), the definition terms (Data Principal, Data Fiduciary), the age of a child (eighteen), the maximum penalty (Rs. 250 crore), the appellate body (TDSAT) and the RTI amendment. A trap: section 43A is omitted by the DPDP Act, but that omission takes effect only on 13 May 2027.

Quick check

1. Under the DPDP Act, 2023, a “child” is an individual who has not completed:
   (A) 13 years
   (B) 16 years
   (C) 18 years
   (D) 21 years
   Answer

   (C). Section 2(f).
2. An appeal against an order of the Data Protection Board lies to:
   (A) the High Court
   (B) the Telecom Disputes Settlement and Appellate Tribunal
   (C) the Central Information Commission
   (D) the National Company Law Appellate Tribunal
   Answer

   (B). Section 29, read with section 44(1), within sixty days.
3. The highest penalty in the Schedule to the DPDP Act, up to Rs. 250 crore, is for:
   (A) failure to notify a breach
   (B) breach of obligations towards children
   (C) failure to take reasonable security safeguards
   (D) breach of a Data Principal’s duties
   Answer

   (C). Breach of section 8(5); notification failure and children each carry up to Rs. 200 crore.
4. Justice K.S. Puttaswamy v. Union of India (2017) was decided by a bench of:
   (A) five judges
   (B) seven judges
   (C) nine judges
   (D) eleven judges
   Answer

   (C). A nine-judge bench held privacy to be a fundamental right.
5. Section 44(3) of the DPDP Act amends:
   (A) section 43A of the IT Act
   (B) section 8(1)(j) of the RTI Act, 2005
   (C) section 14 of the TRAI Act
   (D) section 69 of the IT Act
   Answer

   (B). It substitutes clause (j) of section 8(1) of the RTI Act; the omission of section 43A is in section 44(2).