Indian Democracy in 100 Notes · ⚖️ Theme 4: Judiciary
Privacy after Puttaswamy: data, surveillance, and the state
Until 2017, whether Indians had a fundamental right to privacy was unsettled. Earlier judgments had suggested otherwise, and the question arose again in a challenge to Aadhaar, the biometric identity programme. On 24 August 2017, a nine-judge bench of the Supreme Court decided Justice K.S. Puttaswamy (Retd.) v. Union of India unanimously: privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21, and as part of the freedoms in Part III of the Constitution. The Court overruled earlier decisions to the extent they had denied that protection.
Privacy, however, is not absolute. The judgment requires any restriction to pass a test: it must be backed by law, serve a legitimate state aim, and be proportionate — meaning the intrusion should be no greater than necessary, with procedural safeguards against abuse. That test now frames disputes about data collection, phone interception, facial recognition, and access to personal records. A separate five-judge judgment in 2018 on Aadhaar itself upheld the scheme with limits, including striking down access for private companies — a reminder that Puttaswamy (2017) and the Aadhaar decision (2018) are different judgments.
Parliament later enacted the Digital Personal Data Protection Act, 2023, India's first comprehensive data-protection law, covering how personal data is processed, with a Data Protection Board for adjudication. Debate continues over its scope. Critics argue that exemptions for the state in Section 17, for sovereignty, security, and public order, are broad, and that surveillance authorisation remains largely executive — for example, interception under Section 69 of the Information Technology Act — rather than judicial. Supporters argue that security, crime prevention, and welfare delivery require state access to data, and that exemptions are a normal feature of data laws. The Pegasus spyware allegations, examined by a Supreme Court-appointed committee, are cited by privacy advocates as showing why independent oversight matters; the underlying facts of who used any such tool remain contested and should not be stated as decided findings.
Suggested picture (licence to confirm): Building of The Supreme Court of India.jpg — licence not confirmed, so the image is not embedded here.
Key takeaways
- Puttaswamy (2017) recognised privacy as a fundamental right under Article 21, by a unanimous nine-judge bench.
- Restrictions must satisfy legality, a legitimate aim, and proportionality, with safeguards.
- The DPDP Act, 2023 governs data processing, but state exemptions and surveillance oversight remain debated.
Why it matters for civil studies: Privacy links Fundamental Rights to everyday digital life — identity, phones, health data, and state surveillance.
Discussion question: Should surveillance be authorised by a judge in advance, or is executive authorisation with later review a sufficient safeguard?
Fact-checked copy, 1 November 2026. Disputed claims are attributed in the text; moving topics should be re-checked at the time of reading.