Advancing
Research Through
Open Knowledge

The Digital Personal Data Protection Act, 2023 And The Right To Privacy: A Critical Analysis Of India's New Data Protection Regime

The Digital Personal Data Protection Act, 2023, read with the Digital Personal Data Protection Rules, 2025 notified on 13 November 2025, constitutes India's first comprehensive statutory framework for digital personal data. Anchored in the nine-judge Bench ruling in Justice K.S. Puttaswamy (Retd.) v. Union of India that elevated informational privacy to a fundamental right under Article 21, the Act translates constitutional guarantees into obligations on Data Fiduciaries and rights of Data Principals. This paper critically examines whether the DPDP framework realises the Puttaswamy standards of legality, necessity and proportionality. It scrutinises the consent-centric architecture and 'legitimate uses' under Sections 4 to 7, the rights under Sections 11 to 14, the institutional design of the Data Protection Board of India, the breadth of State exemptions under Sections 7 and 17, the amendment to Section 8(1)(j) of the Right to Information Act, 2005 via Section 44(3), and the phased enforcement timeline culminating in full compliance on 13 May 2027. Drawing on comparative insights from the GDPR and the constitutional challenges pending before the Supreme Court, the paper argues that while the Act marks a decisive legislative advance, structural features, particularly expansive executive exemptions, limited regulatory independence, and the dilution of public-interest overrides, risk subordinating the right to privacy to administrative convenience and State surveillance imperatives. Meaningful realisation of constitutional privacy therefore requires robust judicial scrutiny and targeted legislative refinement.