THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023: A CONSTITUTIONAL AND REGULATORY ANALYSIS

The DPDP Act places a strong emphasis on consent in data processing, which reinforces individual autonomy as a crucial element of privacy. According to Section 6, data fiduciaries must obtain the informed, explicit, and voluntary consent of a data principal before handling their personal information. This consent must be backed by a notice explaining the data being collected and the purpose of its use, ensuring transparency. Data principals can withdraw their consent at any moment, requiring data fiduciaries to stop processing their data (Section 6(5)).

Additionally, the Act empowers data principals with significant rights under Section 11, including:

1. The right to access information regarding how their data is being processed.
2.  The right to correct or delete data.
3. The ability to nominate someone else to exercise these rights in the event of death or incapacity.
4. The right to seek redress for any violations.

These features allow individuals to exert control over their personal data, aligning closely with the emphasis on informational self-determination highlighted in the Puttaswamy case. For example, the right to erasure mirrors the “right to be forgotten” found in Article 17 of the GDPR, adapting international best practices for the context of India.

However, the consent structure in the Act has its limitations. The notion of “deemed consent” for “certain legitimate uses” (Section 7), which includes scenarios like government services or employment, circumvents the need for explicit consent. This raises questions about the potential for coercion, especially among vulnerable individuals who may rely on government assistance. Additionally, the Act’s exclusive reliance on digital complaint mechanisms (Section 28) could leave behind those with limited access to the internet, given that only 52.4% of India’s population had internet access in 2024, according to Datareportal[30]. These shortcomings could hinder the Act’s ability to fully empower privacy rights for all citizens

3.2  Government Exemptions (Section 17) 

Section 17 of the DPDP Act gives the Central Government extensive authority to exclude state entities from the Act’s provisions when it concerns sovereignty, security, public order, foreign relations, or the prevention of serious offenses. Although such exemptions are common in data protection regulations worldwide, the broad scope and potential for misuse raise significant constitutional questions. This section looks into these exemptions, the risks they pose, and their validity under Articles 14, 19, and 21 of the Constitution.

Exemptions for State Instrumentalities: Security, Public Order, Foreign Relations 

Under Section 17(2)(a), the Central Government is allowed to designate any state entity as exempt from the requirements of the DPDP Act, including those related to consent, data deletion, and security responsibilities. The reasons provided—protecting national security, ensuring public order, and managing foreign relations—are certainly valid. For instance, intelligence agencies may need personal data access to tackle terrorism or cyber threats, making some flexibility in data processing essential. 

The exemptions in this Act resemble those in the RTI Act (Section 24), which exempts intelligence and security organizations from disclosure responsibilities, except in cases of corruption or human rights violations. However, the DPDP Act’s exemptions are broader, as they apply to any state entity the government decides to notify, not just specific agencies. This wide-ranging scope means that the government could potentially exempt organizations like public sector banks or welfare agencies—entities that handle sensitive personal data—without providing a clear reason.

Risks of Surveillance and Data Retention 

Section 17 has drawn criticism from scholars who argue that it allows for unchecked surveillance and data retention. The lack of oversight mechanisms or time limits for these exemptions risks granting the state prolonged access to personal data, including biometric and demographic information, far beyond what is necessary. This is particularly alarming given India’s past data breaches, like the exposure of Aadhaar-linked information, which led to increased fraud following the pandemic. The lack of transparency regarding how exempted agencies manage data only heightens the risk of misuse, undermining the right to privacy. 

The Puttaswamy ruling emphasized the necessity of judicial oversight and reasonable limits on surveillance. Yet, the DPDP Act does not call for an independent review of these exemptions, leaving the Central Government as the sole decision-maker. This creates fears around the arbitrary use of power, particularly given claims that agencies like the CBI and ED have been utilized for political ends.

Constitutional Validity Under Articles 14, 19, and 21 

The constitutional legitimacy of Section 17 largely depends on its alignment with Articles 14 (equality), 19 (freedom of speech and expression), and 21 (life and personal liberty): 

1.  Article 14: Equality Before the Law 

Article 14 prohibits arbitrary state action and guarantees equality before the law and equal protection. For any law to comply with Article 14, the classification it creates must have a clear rationale and a logical connection to the law’s aim. The exemptions under Section 17 could violate this principle due to their broad and discretionary nature. 

The vague criteria for granting exemptions set out in Section 17(2)(a) open the door to arbitrary application. Without specific standards or oversight, the government could selectively exempt agencies, failing to justify the need or extent of such exemptions. This unchecked discretion doesn’t adhere to the “reasonable classification” test, as it lacks a rational link between the exemption and the Act’s goals of protecting privacy and ensuring legal data processing. The Supreme Court’s ruling in State of West Bengal v. Anwar Ali Sarkar (1952) pointed out that laws granting unfettered discretion to the executive are prone to arbitrariness, which is a relevant concern for Section 17. 

Furthermore, these exemptions lead to an uneven application of data protection standards: private data handlers must comply with stringent regulations, while exempted state entities do not face similar requirements. This disparity undermines the Act’s objective of providing consistent privacy protection, potentially infringing on Article 14’s assurance of equal protection. To align with Article 14, the DPDP Act needs to establish clear criteria for exemptions and include independent oversight mechanisms, like judicial or parliamentary review, to guard against arbitrary state actions.

• Article 19(1)(a): Freedom of Speech and Expression

Article 19(1)(a) safeguards freedom of speech and expression, which was linked to the right to privacy in the Puttaswamy case. It noted that informational privacy is crucial for free expression. Unfortunately, some provisions of the DPDP Act, especially regarding the amendments to the RTI under Section 44(3) and exemptions in Section 17, threaten this right by limiting transparency and enabling potential surveillance. 

Surveillance Risks from Exemptions 

The exemptions for state entities in Section 17, particularly the lack of limits on data retention, raise serious surveillance concerns. Agencies exempted under this section can keep personal information indefinitely, even after they’ve fulfilled their original purpose for collection, leading to the risk of mass surveillance. This situation is reminiscent of criticisms surrounding the Aadhaar scheme for enabling surveillance due to its insufficient data security. Such potential for unrestricted access to data could lead to a chilling effect on free expression; individuals might self-censor to avoid surveillance, infringing on Article 19(1)(a). 

The Anuradha Bhasin v. Union of India case highlighted the need for proportionality when placing restrictions on fundamental rights. The court ruled that limitations must be narrowly defined and subject to regular reviews, standards that Section 17 fails to meet due to its broad exemptions and absence of oversight. To comply with Article 19, the DPDP Act should narrow these exemptions, impose time limits on data retention, and reinstate public interest exceptions in the RTI amendment to enhance transparency.

•  Article 21: Right to Life and Personal Liberty

According to the Puttaswamy judgment, the right to privacy is protected by Article 21 alongside the rights to life and personal liberty. It established a three-part test—legality, necessity, and proportionality—for laws that restrict privacy. While the DPDP Act’s focus on informed consent (Section 6) and data principal rights (Section 11), such as the rights to access, correction, and erasure, align with these principles, the exemptions and enforcement gaps raise constitutional issues. 

Consent and Data Principal Rights

The emphasis in the DPDP Act on informed consent and data principal rights supports individuals’ control over their personal information, satisfying the legality and necessity requirements. These provisions reflect an autonomy-focused vision of privacy, ensuring lawful and purpose-limited data processing. However, the reliance on digital means to exercise these rights overlooks those with limited internet access. Given that only 52.4% of India’s population had internet access in 2023, this digital divide threatens to make privacy protections inaccessible, compromising Article 21’s guarantee of universal rights.

Government Exemptions and Proportionality 

The exemptions outlined in Section 17 don’t meet the proportionality test because they’re too broad and lack adequate safeguards. This provision allows state entities to bypass consent and data protection obligations under vague premises like “friendly relations with foreign states,” all without any judicial or parliamentary oversight. The Puttaswamy judgment emphasized that restrictions on privacy should be carefully limited and should come with procedural safeguards, a point that’s supported in Anuradha Bhasin as well. Without a sunset clause or a review mechanism for these exemptions, we’re looking at a situation where the state could have unlimited access to personal data, which undermines the procedural fairness guaranteed by Article 21. 

The risk of surveillance, which is amplified by the potential for unlimited data retention, puts privacy further at risk. The failure of the DPDP Act to establish security standards for exempted agencies only heightens the chances of data breaches, similar to what we saw with the Aadhaar program. To comply with Article 21, the Act needs to implement oversight mechanisms, like creating a judicial committee to review exemptions, and set clear security standards for all data fiduciaries, including government bodies. 

4: RECOMMENDATION AND CONCLUSION

4.1  Recommendations for Strengthening the DPDP Framework