Data protection refers to:
Legal and institutional safeguards governing the collection, use, storage, sharing and deletion of personal data.
In constitutional terms, data protection is closely connected with:
Privacy + dignity + autonomy + equality + freedom.
The principal constitutional basis is:
Article 21 → Right to life and personal liberty.
Data protection also intersects with:
Article 14 → Equality and non-arbitrariness.
Article 19(1)(a) → Freedom of speech and expression.
Article 19(1)(g) → Freedom of profession and business.
Other Part III rights depending on the nature of data processing.
The Supreme Court recognised privacy as a:
Constitutionally protected fundamental right
in:
K.S. Puttaswamy (Retd.) v. Union of India, 2017.
A:
Nine-judge Constitution Bench
unanimously held that:
Privacy is a fundamental constitutional right.
Privacy derives principally from:
Article 21
and is reinforced by:
Other freedoms and rights under Part III.
Informational privacy means:
An individual's ability to exercise meaningful control over information relating to them.
Data protection converts the broad constitutional idea of:
Informational autonomy
into:
Concrete legal duties and individual rights.
The right to privacy can be restricted.
However, State action affecting privacy must satisfy:
Constitutional standards.
A privacy-infringing measure broadly requires:
There must be:
A valid legal basis
for significant State intrusion into privacy.
The State must pursue:
A constitutionally legitimate objective.
The measure must have:
A rational and proportionate relationship
with the legitimate objective.
The State should avoid:
Excessive or unnecessary intrusion
where less intrusive alternatives are reasonably available.
Data processing can raise Article 14 issues where:
Individuals are treated arbitrarily or discriminatory outcomes result.
Automated systems may produce:
Unequal or discriminatory outcomes.
Therefore:
Data protection and equality are increasingly interconnected.
Data collection can affect:
Freedom of speech and expression.
Excessive surveillance may cause people to:
Avoid expressing opinions.
This creates a:
Chilling effect.
Monitoring political or social associations can affect:
Freedom of association.
Privacy protects:
A private sphere in which individuals can think, communicate and organise without disproportionate surveillance.
India enacted:
Digital Personal Data Protection Act, 2023.
The Act seeks to regulate:
Processing of digital personal data
while recognising:
The individual's right to protect personal data
and:
The need to process data for lawful purposes. (indiacode.nic.in)
The Act applies to:
Digital personal data
processed within the statutory framework.
It can also apply to certain processing outside India where:
It is connected with offering goods or services to Data Principals in India.
Individual to whom the personal data relates.
Person/entity determining the purpose and means of processing personal data.
Person/entity processing data on behalf of a Data Fiduciary.
The Act recognises:
Consent
as one basis for lawful processing.
Consent must generally be:
Free + specific + informed + unconditional + unambiguous
and involve:
Clear affirmative action.
The Data Fiduciary must provide:
Notice concerning the personal data and purpose of processing,
subject to the statutory framework.
Consent is:
Not the only basis for processing.
The Act also recognises:
Certain legitimate uses.
Personal data should be processed:
For lawful purposes under the statutory framework.
A sound constitutional data-protection principle is:
Collect only data reasonably necessary for the intended purpose.
Where personal data is used to make decisions affecting individuals, data fiduciaries have obligations concerning:
Accuracy and completeness.
Data Fiduciaries must implement:
Reasonable security safeguards
to prevent:
A breach can involve:
Unauthorised access, disclosure, alteration, loss or compromise of personal data.
The DPDP framework contains:
Obligations concerning notification of personal-data breaches.
The Act provides Data Principals with rights relating to:
A Data Principal can seek:
Information concerning their personal data being processed,
subject to statutory conditions.
Individuals can request:
Correction of inaccurate or misleading personal data.
Individuals can request:
Erasure of personal data where legally applicable.
Data Fiduciaries must provide:
A mechanism for grievance redressal.
The Act allows:
Nomination of another person
to exercise specified rights in case of:
Death or incapacity.
The Act provides enhanced protection for:
Children's personal data.
For the DPDP framework:
Child means an individual below 18 years.
Processing children's data generally requires:
Verifiable parental consent,
subject to statutory exceptions.
The framework restricts certain activities involving children, including:
Targeted advertising
and certain:
Behavioural monitoring or tracking,
subject to the statutory framework.
The Government can designate entities as:
Significant Data Fiduciaries.
Because their processing may present:
Greater risks to individuals or significant public interests.
Significant Data Fiduciaries may have requirements concerning:
A Significant Data Fiduciary must appoint:
Data Protection Officer
as required by the law and Rules.
A DPIA assesses:
Risks arising from data-processing activities.
The Act creates:
Data Protection Board of India.
The Board performs:
Specified regulatory and adjudicatory functions
under the Act.
The DPDP Act is being brought into force:
In phases.
Different provisions have different commencement dates. (indiacode.nic.in)
The:
Digital Personal Data Protection Rules, 2025
were notified on:
13 November 2025.
The Rules also have:
Phased commencement.
Some provisions took effect immediately, while others take effect:
One year or eighteen months
after notification. (indiacode.nic.in)
As of:
August 2026,
the DPDP framework is:
In phased implementation.
Therefore:
Not every substantive obligation is yet operational.
The Act contains:
Specific exemptions and lawful-use provisions
for certain governmental processing.
Government access to personal data can raise:
Privacy + surveillance + proportionality
questions.
Data processing may be justified for:
National security is:
Not a blanket exemption from constitutional scrutiny.
Surveillance involves:
Monitoring or collecting information about individuals or communications.
A surveillance framework should have:
Legal authority + legitimate aim + proportionality + procedural safeguards.
The Pegasus controversy raised concerns regarding:
State surveillance + privacy + constitutional safeguards.
The Supreme Court constituted an:
Expert Technical Committee
to examine allegations concerning Pegasus spyware.
Aadhaar became a major test of:
Biometric data + informational privacy.
The Supreme Court examined:
Collection and use of personal and biometric information.
Digital identity systems can improve:
Welfare delivery + authentication.
But they may also create:
Data concentration and surveillance risks.
Centralised databases create potential risks involving:
Privacy protects:
The ability to communicate and associate without disproportionate monitoring.
Anonymity can:
Protect vulnerable speech.
But anonymity can also facilitate:
Abuse or unlawful activity.
The constitutional balance depends on:
Context and lawful justification.
Privacy may conflict with:
Public access to information.
The Electoral Bonds judgment illustrates that:
Donor privacy is not absolute.
The Supreme Court held that the public's right to information concerning political funding outweighed the anonymous funding mechanism created by the scheme. (api.sci.gov.in)
The constitutional task is:
Balancing privacy against legitimate public interests.
Journalistic activity may require:
Confidential sources + access to information.
Data regulation must therefore be balanced against:
Freedom of the press.
Businesses process personal data for:
Consumers may have:
Limited bargaining power
when agreeing to lengthy digital terms.
Formal consent may not always provide:
Meaningful understanding or genuine choice.
A better approach is:
Build privacy safeguards into technology from the beginning.
Organisations should avoid:
Unnecessary collection of personal data.
Data should not be:
Used for unrelated purposes without a lawful basis.
Personal data should not be:
Retained indefinitely without legitimate justification.
Strong security requires:
A serious breach can affect:
Privacy + financial security + identity + reputation.
Children are especially vulnerable to:
Digital rights are not limited to:
Privacy.
They also include:
Meaningful access to digital systems.
Lack of:
can create:
Inequality in access to public services.
Digital systems should not create:
Arbitrary or discriminatory outcomes.
AI systems may make or influence decisions concerning:
Biased training data can produce:
Discriminatory outcomes.
High-impact automated systems may require:
Explainability + accountability.
Data protection therefore intersects with:
Administrative law + equality + due process.
Large-scale facial recognition can involve:
Biometric processing + surveillance.
It raises strong:
Privacy and proportionality concerns.
Location data can reveal:
Movements + habits + relationships.
Therefore:
It can be highly privacy-sensitive.
Even without reading message content, metadata can reveal:
Therefore:
Privacy concerns are not limited to message content.
Data localisation concerns:
Where personal data is stored or processed.
Digital businesses routinely process:
Data across jurisdictions.
Therefore:
Cross-border data governance is a major policy issue.
The DPDP Act contains:
Provisions concerning processing of personal data outside India
and:
Government powers concerning restrictions under the statutory framework.
Governs how personal data is collected and used.
Protects systems and data from attacks or unauthorised access.
Strong cybersecurity is:
Necessary but not sufficient
for:
Data protection.
Consent should not become:
A mechanism for organisations to escape all accountability.
Data Fiduciaries have:
Independent compliance responsibilities.
Data protection can protect multiple constitutional interests:
Equality + non-arbitrariness.
Speech + association + occupation.
Privacy + dignity + autonomy.
Fundamental rights traditionally operate primarily against:
State action.
But:
Data protection legislation can impose obligations directly on private entities.
This represents:
Legislative extension of privacy protection into private-sector data processing.
Constitution:
Establishes fundamental rights.
Legislation:
Creates detailed operational safeguards.
Courts can examine:
Data-protection laws and State data-processing measures
for constitutional validity.
The proportionality principle remains important when:
State action intrudes upon privacy.
A difficult constitutional balance exists between:
Privacy
and:
Security needs.
National security measures should still have:
Legal basis + safeguards + proportionality.
Integrate privacy into technology from the beginning.
Collect only necessary data.
Protect against breaches and misuse.
Ensure meaningful institutional accountability.
Explain data-processing practices clearly.
Ensure government data access is narrowly tailored.
Protect those lacking digital access or literacy.
Apply stronger safeguards to children's data.
The strongest UPSC formulation is:
"Data protection gives practical meaning to the constitutional right to informational privacy by placing limits on both State and private-sector processing of personal data."
The recognition of privacy as a fundamental right in Puttaswamy transformed data protection from a primarily regulatory concern into a constitutional-rights issue. In the digital economy, personal data can affect privacy, dignity, equality, speech and autonomy.
Puttaswamy, 2017 → Privacy fundamental right.
Puttaswamy (Aadhaar), 2018 → Informational privacy and proportionality.
Shreya Singhal, 2015 → Online speech.
Anuradha Bhasin, 2020 → Internet-related rights.
Pegasus proceedings → Surveillance concerns.
DPDP Act, 2023 → Digital personal-data protection.
DPDP Rules, 2025 → Detailed operational framework.
Data protection should be viewed as a constitutional bridge between technology and fundamental rights. The objective is not to prevent data use, but to ensure that innovation, governance and digital services operate without disproportionate sacrifice of privacy, dignity, equality and individual autonomy.
