Privacy refers to:
The individual's right to control personal information, personal choices, bodily integrity, communications and aspects of private life.
Digital rights refer to:
Rights and freedoms exercised or affected through digital technologies and the Internet.
Privacy is primarily protected through:
Article 21 — Right to life and personal liberty.
It also connects with:
The Supreme Court unanimously recognised privacy as a:
Constitutionally protected fundamental right
in:
K.S. Puttaswamy (Retd.) v. Union of India, 2017.
A:
Nine-judge Constitution Bench
held that:
Privacy is a constitutionally protected right.
The Court located privacy principally within:
Article 21
and also connected it with:
Other freedoms and rights under Part III.
Privacy includes aspects such as:
Informational privacy concerns:
Collection, processing, storage, use and disclosure of personal data.
The right to privacy:
Is not an absolute right.
Restrictions can be constitutionally valid if:
They satisfy the required constitutional test.
A privacy-restricting measure must broadly satisfy:
There must be a valid law.
The restriction must pursue a legitimate objective.
The means adopted must have a rational and proportionate relationship with the objective.
A privacy intrusion should therefore be:
Lawful + necessary + proportionate.
Privacy protects:
Individual control over personal information.
This is particularly important in:
Digital societies.
Digital personal data includes:
Information relating to an identifiable individual in digital form.
Examples may include:
India enacted:
Digital Personal Data Protection Act, 2023.
The Act seeks to:
Regulate processing of digital personal data
while recognising:
Individuals' rights
and:
Lawful data-processing needs.
The Central Government notified:
Digital Personal Data Protection Rules, 2025
on:
13 November 2025.
The Rules establish the operational framework for the 2023 Act. :contentReference[oaicite:1]{index=1}
The Rules do not all become operative simultaneously.
Under the notification:
Rules 1, 2 and 17–21 came into force on publication.
Rule 4 comes into force one year after publication.
Rules 3, 5–16, 22 and 23 come into force eighteen months after publication. :contentReference[oaicite:2]{index=2}
As of:
August 2026,
the DPDP framework is therefore:
In phased implementation,
rather than having every substantive obligation immediately operative. :contentReference[oaicite:3]{index=3}
Under the DPDP framework, the individual to whom personal data relates is:
Data Principal.
The entity determining:
Purpose and means of processing personal data
is:
Data Fiduciary.
A:
Data Processor
may process personal data:
On behalf of a Data Fiduciary.
Consent-based processing requires:
Free + specific + informed + unconditional + unambiguous consent,
with a:
Clear affirmative action.
The Data Fiduciary must provide:
Notice regarding the personal data being processed and the purpose of processing,
subject to the Act and Rules.
A Data Principal has the ability to:
Withdraw consent,
subject to the applicable legal framework.
Personal data should be processed:
For lawful and specified purposes.
A strong privacy principle is:
Collect only what is reasonably necessary for the specified purpose.
Data Fiduciaries have obligations relating to:
Accuracy and completeness
where personal data is used for:
Decisions affecting the Data Principal.
Data Fiduciaries must adopt:
Reasonable security safeguards
against:
A data breach involves:
Unauthorised processing, disclosure, alteration, destruction or loss of personal data,
depending on the statutory framework.
The DPDP framework contains:
Obligations concerning notification of personal-data breaches.
The Act provides rights relating to:
A Data Principal can seek:
Information about personal data being processed,
subject to:
Statutory conditions.
Individuals can request:
Correction of inaccurate data
and:
Erasure where legally applicable.
Data Fiduciaries must provide:
Mechanisms for grievance redressal.
The framework permits:
Nomination of another individual
to exercise specified rights in the event of:
Death or incapacity,
subject to the Act.
Privacy regulation does not create:
Rights without responsibilities.
Data Principals have statutory duties, including:
Providing authentic information and complying with applicable law.
The DPDP framework provides enhanced safeguards for:
Children.
The Act defines a child as:
An individual who has not completed eighteen years of age.
Processing children's personal data generally requires:
Verifiable parental consent,
subject to:
Statutory exemptions.
The framework places restrictions on:
subject to the statutory framework and prescribed exemptions.
The Government may notify certain entities as:
Significant Data Fiduciaries.
Because their:
Volume or sensitivity of data processing
or:
Potential impact on sovereignty, security or public interest
may create greater risks.
Significant Data Fiduciaries may have additional requirements concerning:
A Significant Data Fiduciary must appoint:
A Data Protection Officer
with responsibilities under the Act and Rules.
A DPIA assesses:
Risks to Data Principals
arising from:
Data processing activities.
The Act establishes:
Data Protection Board of India.
The Board is intended to:
Adjudicate specified contraventions
and:
Perform functions assigned under the Act.
The Government notified measures relating to:
Establishment of the Data Protection Board
in November 2025. :contentReference[oaicite:4]{index=4}
The DPDP framework permits:
Cross-border processing/transfers
subject to:
Government restrictions that may be prescribed.
India's DPDP framework:
Does not simply copy the European GDPR model.
It adopts:
An Indian statutory framework balancing privacy with lawful data processing and governance needs.
The Act permits specified exemptions for:
Certain State instrumentalities and processing activities
subject to:
Statutory conditions.
Privacy can be restricted where:
National security and other constitutionally legitimate interests
justify the intervention,
provided:
Constitutional standards are satisfied.
Digital rights are broader than:
Personal-data protection.
They include:
Article 19(1)(a):
Applies to expression through the Internet.
In:
Anuradha Bhasin v. Union of India, 2020,
the Supreme Court held that:
Freedom of speech and expression through the Internet is constitutionally protected.
Restrictions on Internet access must satisfy:
Legality + necessity + proportionality.
There is:
No simple constitutional formula stating that everyone has an unlimited fundamental right to uninterrupted Internet access in every circumstance.
The constitutional protection concerns:
Rights exercised through the Internet.
Internet restrictions cannot become:
Indefinite or arbitrary.
They require:
Review and proportionality.
Digital speech includes:
In:
Shreya Singhal v. Union of India, 2015,
the Supreme Court struck down:
Section 66A of the Information Technology Act.
Section 66A was:
Vague and overbroad.
It created a:
Chilling effect
on legitimate online expression.
State surveillance can involve:
Collection and processing of personal communications and metadata.
Surveillance may affect:
A surveillance measure should satisfy:
Legal authority + legitimate objective + necessity + proportionality + safeguards.
The:
Pegasus spyware controversy
raised concerns regarding:
Surveillance, privacy and constitutional safeguards.
In:
2021,
the Supreme Court established an:
Expert Technical Committee
to examine allegations relating to Pegasus spyware.
The Aadhaar litigation became a major test of:
Informational privacy.
In:
K.S. Puttaswamy (Aadhaar) v. Union of India, 2018,
the Supreme Court examined:
Collection and use of personal and biometric information.
The Court's privacy jurisprudence reinforced:
Need for law + legitimate purpose + proportionality.
Biometric information includes:
Biometric data raises strong privacy concerns because:
It is deeply linked to individual identity.
People should have meaningful protection against:
Unauthorised or disproportionate use of personal data.
Artificial intelligence creates new privacy risks involving:
Facial-recognition systems may involve:
Large-scale biometric processing.
This raises:
Privacy + surveillance concerns.
Profiling involves:
Analysing data to infer characteristics, behaviour or preferences.
Automated systems can affect:
Biased algorithms can produce:
Discriminatory outcomes.
Digital privacy and algorithmic governance therefore connect:
Article 14
with:
Article 21.
Consent is important, but:
Mere formal consent is not always sufficient to eliminate privacy concerns.
Users may:
Lack meaningful bargaining power
when accepting:
Long and complex digital terms.
Modern digital privacy faces:
Information overload + lack of meaningful understanding.
Organisations should therefore:
Design systems that protect data rather than relying solely on user vigilance.
Privacy by design means:
Building privacy safeguards into technology and processes from the beginning.
Good digital governance requires:
Protects systems and information from unauthorised access or attack.
Controls how personal information is collected and used.
They are:
Related but distinct.
Digital identity systems can improve:
Service delivery and authentication.
But may increase:
Surveillance and privacy risks
if poorly governed.
Digital welfare systems increasingly use:
Personal and biometric data.
This creates a balance between:
Efficient service delivery
and:
Individual privacy.
Data localisation refers to:
Requirements concerning where data is stored or processed.
Arguments for localisation:
Arguments against excessive localisation:
Children require stronger protection against:
Digital rights also require:
Meaningful access to digital infrastructure.
The digital divide refers to:
Unequal access to digital devices, connectivity, skills and services.
Unequal access to digital systems can affect:
Equal opportunity.
Digital exclusion can affect:
Dignity + access to essential services.
Systems such as:
can improve:
Access and efficiency.
But require:
Privacy + security + inclusion.
Privacy jurisprudence has raised:
Questions about whether individuals can seek removal or de-indexing of certain personal information.
A right to privacy can conflict with:
Freedom of speech and the public's right to information.
Courts may need to balance:
Privacy
against:
Public interest + free expression + legitimate journalism.
Political funding and privacy can sometimes conflict.
The Supreme Court's:
2024 Electoral Bonds judgment
illustrated that:
Donor privacy may yield where it unjustifiably defeats voters' constitutional right to information. :contentReference[oaicite:5]{index=5}
Privacy helps citizens:
Think, associate and participate politically
without:
Constant fear of surveillance.
Excessive surveillance can cause:
Self-censorship.
This links:
Article 21 privacy
with:
Article 19 freedoms.
Surveillance of political associations may affect:
Freedom of association.
A democratic society requires:
A private sphere in which individuals can develop opinions freely.
Government data-processing systems should operate under:
Clear legal authority.
Citizens should know:
How their data is being collected and used,
subject to:
Legitimate security exceptions.
Digital institutions require:
Independent oversight + audit + grievance mechanisms.
Digital governance should respect:
Dignity + autonomy + equality + liberty.
India's digital privacy architecture now involves:
The DPDP Rules were notified in:
November 2025,
and the Government describes the Act and Rules as the operational framework for digital personal-data protection, with:
An eighteen-month phased compliance timeline. :contentReference[oaicite:6]{index=6}
Integrate privacy safeguards into digital systems.
Avoid excessive collection and surveillance.
Ensure meaningful regulatory accountability.
Collect only necessary data.
Explain data-processing purposes clearly.
Prevent breaches and unauthorised access.
Make correction, erasure and grievance rights practical.
Ensure digital services remain accessible to those with limited digital capacity.
The strongest UPSC formulation is:
"Digital rights transform the traditional idea of privacy from protection against physical intrusion into a broader constitutional guarantee of informational autonomy, dignity and control over one's digital identity."
The Supreme Court's recognition of privacy as a fundamental right in Puttaswamy transformed India's constitutional framework for the digital age. Privacy now encompasses informational autonomy, while digital rights extend to online expression, data protection, cybersecurity and equal access to digital systems.
Puttaswamy, 2017 → Privacy is a fundamental right.
Puttaswamy (Aadhaar), 2018 → Informational privacy + proportionality.
Shreya Singhal, 2015 → Online speech.
Anuradha Bhasin, 2020 → Internet-based expression + shutdown restrictions.
Pegasus proceedings → Surveillance and privacy safeguards.
DPDP Act, 2023 → Digital personal-data protection.
DPDP Rules, 2025 → Operational rules with phased commencement.
The central constitutional task is to ensure that technological progress does not make privacy obsolete. India's digital-governance framework should pursue innovation and efficient public services while preserving individual autonomy, dignity, equality and freedom from disproportionate surveillance or data exploitation.
