India’s Privacy Crossroads: The Digital Personal Data Protection Act, 2023
Balancing fundamental rights with state surveillance
Global lessons for India’s digital future
By Vishwas Kumar
New Delhi: June 27, 2026:
India’s digital economy is expanding at an unprecedented pace, with millions of citizens relying on Aadhaar, mobile banking, e-commerce, and social media platforms for everyday transactions and communication. In this landscape, personal data has become both a valuable resource and a potential vulnerability. The Digital Personal Data Protection Act, 2023 (DPDP Act) represents India’s first comprehensive attempt to regulate this new reality, aiming to safeguard individual privacy while enabling innovation and governance in the digital age.
The Act was born out of the Supreme Court’s landmark Justice K.S. Puttaswamy v. Union of India (2017) judgment, which recognized privacy as a fundamental right under Article 21 of the Constitution. That ruling created a constitutional imperative for Parliament to legislate protections against misuse of personal data. The DPDP Act is the legislative response, establishing a framework for how personal data is collected, processed, stored, and transferred.
Yet, the Act has sparked intense debate. Supporters hail it as a milestone that finally gives Indian citizens rights over their digital identities. Critics, however, argue that its sweeping government exemptions and weak enforcement mechanisms risk hollowing out those rights. Section 17, which allows the state to exempt its agencies for reasons such as national security and public order, has been singled out as particularly problematic. Businesses, meanwhile, worry about compliance costs and uncertainty around cross-border data transfers, which are permitted only to “trusted jurisdictions” defined by the government.
The DPDP Act thus sits at the intersection of constitutional rights, state surveillance, and economic innovation. It is both a promise and a warning: a promise of stronger privacy protections, and a warning that without reform, those protections may remain more symbolic than substantive. India now faces the challenge of ensuring that its digital future is built on trust, accountability, and respect for individual autonomy.
The Constitutional Backdrop
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first comprehensive privacy law, born out of the Supreme Court’s landmark Justice K.S. Puttaswamy v. Union of India (2017) ruling that recognized privacy as a fundamental right under Article 21. The Act seeks to regulate how personal data is collected, processed, and stored by both private companies and government agencies. Yet, its broad exemptions for state surveillance and limited enforcement mechanisms have sparked fierce debate.
Key Provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act):
Key Provisions of the DPDP Act
The Digital Personal Data Protection Act, 2023 (DPDP Act) marks India’s first comprehensive attempt to regulate personal data in the digital age. While it introduces important safeguards, its provisions also raise questions about balance between individual rights, state power, and business innovation. Let’s explore its core pillars in detail.
1. Consent Framework
At the heart of the DPDP Act lies the principle of consent. Individuals, referred to as “data principals,” must provide explicit consent before their personal data can be processed. This includes information such as names, addresses, financial details, health records, and online identifiers. The Act requires that consent be free, informed, specific, and unambiguous. Importantly, individuals have the right to withdraw consent at any time, and data fiduciaries—entities processing data—must respect this decision.
Beyond consent, the Act grants rights of correction and grievance redressal, allowing individuals to demand rectification of inaccurate data and seek remedies for misuse. This framework is designed to empower citizens, but critics argue that in practice, consent may become a mere formality, especially when government exemptions override it.
2. Government Exemptions
Perhaps the most controversial provision is Section 17, which allows the government to exempt its agencies from compliance with the Act for reasons such as national security, public order, and prevention of crime. While such exemptions are common globally, the breadth of India’s clause is striking. It grants the statewide discretion, raising fears that surveillance could be legitimized under the guise of security.
Civil society groups warn that this undermines the spirit of the Puttaswamy judgment, which emphasized privacy as a fundamental right. Without clear limits or judicial oversight, Section 17 risks becoming a loophole that swallows the rule.
3. Cross-Border Transfers
The DPDP Act permits cross-border data transfers to “trusted jurisdictions” notified by the government. This provision is crucial for global businesses and startups that rely on international data flows. However, the criteria for determining trusted jurisdictions remain opaque. Unlike the EU’s GDPR, which has transparent adequacy decisions, India’s model leaves businesses uncertain about where data can legally travel.
This ambiguity could discourage investment and complicate compliance for multinational companies. Startups, in particular, fear delays in expansion due to unclear rules on data transfers.
4. Data Protection Board
To enforce compliance, the Act establishes a Data Protection Board of India. The Board is tasked with handling grievances, monitoring fiduciaries, and imposing penalties for violations. On paper, this is a significant step toward accountability. Yet, concerns persist about its independence. Since appointments and oversight are controlled by the government, critics argue the Board may lack autonomy, especially when adjudicating cases involving state agencies.
Without genuine independence, the Board risks being perceived as a rubber stamp rather than a watchdog, weakening trust in the system.
5. Children’s Data
The Act introduces special safeguards for minors, recognizing their vulnerability in the digital ecosystem. Data fiduciaries must obtain parental consent before processing children’s data and are prohibited from engaging in practices that could harm minors, such as targeted advertising or profiling.
This provision is widely welcomed, given rising concerns about children’s exposure to online risks. However, implementation challenges remain—how will companies verify parental consent at scale, and how will enforcement be ensured in practice?
Conclusion
Together, these provisions reflect India’s attempt to balance privacy rights with state interests and business needs. The consent framework empowers individuals, but government exemptions dilute its strength. Cross-border transfer rules aim to facilitate global commerce but lack clarity. The Data Protection Board promises enforcement but faces questions of independence. And children’s safeguards highlight a commitment to protecting vulnerable groups, though practical hurdles persist.
The DPDP Act is a landmark step, but its success will depend on how these provisions are interpreted, enforced, and reformed. India stands at a crossroads: it can evolve the Act into a robust privacy regime that builds trust in its digital economy, or risk undermining the very rights it set out to protect.
Comparative Perspectives
EU (GDPR): Strong rights like portability and erasure, independent regulators, and strict penalties.
US: Fragmented sectoral laws, innovation-friendly but weak on individual rights.
China: State-centric model emphasizing control and localization.
India: Hybrid approach—recognizes privacy rights but tilts toward state power.
Case Studies & Human Narratives
Citizens: Concerns about Aadhaar, health records, and financial data being misused.
Startups: Fear compliance costs and uncertainty around cross-border rules.
Civil Society: Warns that government exemptions undermine the spirit of Puttaswamy.
For example, a Bengaluru fintech startup reported delaying its global expansion because of unclear rules on data transfers, while a Delhi activist worries her health records could be accessed without consent under state exemptions.
FAQ Index on India’s DPDP Act, 2023
What is the DPDP Act, 2023? It is India’s first comprehensive law regulating personal data collection, processing, and storage.
Why was the Act introduced? It follows the Supreme Court’s Puttaswamy ruling that recognized privacy as a fundamental right.
Who are “data principals”? Individuals whose personal data is being processed.
Who are “data fiduciaries”? Entities (companies, organizations, government bodies) that process personal data.
What rights do data principals have? Consent, correction, grievance redressal, and limited rights to erasure.
What is the role of consent? Consent is central—data cannot be processed without it, except under exemptions.
What are “legitimate uses” without consent? Processing allowed for state functions, employment, or emergencies.
What is Section 17’s government exemption? It allows the government to exempt its agencies for reasons like national security.
Why is Section 17 controversial? Critics argue it undermines privacy by giving the state sweeping powers.
What is the Data Protection Board? A regulatory body to enforce compliance and handle grievances.
Is the Board independent? Its independence is questioned since appointments are controlled by the government.
How does the Act treat children’s data? Requires parental consent and prohibits harmful processing.
Are cross-border transfers allowed? Yes, but only to “trusted jurisdictions” notified by the government.
What is unclear about cross-border rules? The criteria for trusted jurisdictions are not transparent.
How does the Act compare to GDPR? GDPR provides stronger rights and independent regulators; India’s Act is weaker.
Does the Act provide a right to be forgotten? Not explicitly; only limited correction and erasure rights.
What penalties exist for violations? Fines up to ₹250 crore depending on severity.
How does the Act affect startups? Compliance costs and uncertainty about global data transfers pose challenges.
Does the Act apply to government agencies? Yes, but exemptions allow them to bypass compliance.
What constitutional principles are implicated? Privacy under Article 21, property rights under Article 300A, and free speech under Article 19(1)(a).
How does the Act affect Aadhaar data? It regulates processing but exemptions may allow state use without consent.
What about health data? Covered under personal data, requiring consent unless exempted.
Does the Act cover financial data? Yes, banks and fintechs must comply with consent and security rules.
How do citizens file complaints? Through the Data Protection Board’s grievance redressal mechanism.
What remedies exist for violations? Damages, penalties, and corrective orders.
How does the Act affect global tech companies? They must comply with Indian rules, including cross-border transfer restrictions.
Does the Act encourage innovation? It aims to, but critics say compliance burdens may stifle startups.
What role does Parliament play now? It may need to amend the Act to strengthen privacy protections.
How do civil society groups view the Act? They argue it dilutes privacy by prioritizing state power.
What reforms are being debated? Stronger independence for regulators, narrower exemptions, clearer global rules.
Does the Act cover non-digital data? No, it applies only to digital personal data.
How does the Act define “personal data”? Any data relating to an identifiable individual.
What is “sensitive personal data”? The Act does not separately define it, unlike GDPR.
How does the Act treat anonymized data? It excludes anonymized data from regulation.
Can individuals withdraw consent? Yes, but only prospectively, not retroactively.
What happens if consent is withdrawn? Data fiduciaries must stop processing unless exempted.
Does the Act cover non-profit organizations? Yes, if they process personal data digitally.
How does the Act affect employment data? Employers can process data without consent for legitimate uses.
What is the risk of broad exemptions? They may undermine trust and weaken privacy protections.
Who should ultimately decide reforms—courts or Parliament? Parliament, since only legislation can create stronger safeguards.
Op-Ed Closing Vision
India’s Digital Personal Data Protection Act, 2023, is both a milestone and a missed opportunity. It represents the country’s first serious attempt to codify privacy protections in the digital age, a long-awaited response to the Supreme Court’s Puttaswamy judgment that elevated privacy to the status of a fundamental right. Yet, while the Act acknowledges the importance of individual consent and introduces a framework for data governance, it simultaneously risks hollowing out these protections through sweeping government exemptions and weak enforcement mechanisms. The paradox is stark: India has legislated privacy, but in practice, it may have legislated surveillance.
The consent framework is a step forward. For the first time, individuals—called “data principals”—are given rights to control how their personal information is collected, processed, and corrected. This is no small achievement in a country where Aadhaar, mobile penetration, and digital payments have made personal data ubiquitous. But the framework is undermined by the breadth of exemptions. Section 17 allows government agencies to bypass compliance for reasons as broad as “national security” or “public order.” Without clear limits, these exemptions risk becoming the rule rather than the exception, leaving citizens vulnerable to unchecked state power.
Globally, India’s model sits uneasily between two poles. On one side is the European Union’s General Data Protection Regulation (GDPR), which is rights-centric, empowering individuals with strong protections like the right to be forgotten and backed by independent regulators. On the other side is China’s state-centric model, where privacy is subordinated to state control and data localization. India’s DPDP Act borrows elements from both but leans closer to the latter, privileging state interests over individual autonomy. This positioning raises questions about India’s digital credibility on the global stage. If India leans too far toward surveillance, it risks undermining trust in its digital economy. If it fails to provide clarity for businesses, startups may struggle to innovate and expand globally.
The solution lies in reform. Parliament must act decisively to strengthen the independence of the Data Protection Board, ensuring it is not merely an extension of executive power. Government exemptions must be narrowed, with clear definitions and judicial oversight to prevent abuse. Rules for cross-border transfers must be transparent, providing certainty for businesses that rely on global data flows. Citizens must retain meaningful control over their data, not just token consent that can be overridden at will. Businesses, too, need certainty, not ambiguity, to plan compliance and innovate confidently.
This is not merely a legal debate—it is a cultural and economic one. Privacy is the foundation of trust in the digital age. Without it, citizens fear surveillance, businesses hesitate to innovate, and India risks losing credibility on the global stage. The DPDP Act must evolve into a framework that protects individuals while enabling innovation. The stakes are high: India’s digital economy is projected to reach trillions in value, but without trust, growth will be fragile. Citizens will resist adoption, businesses will face reputational risks, and international partners may hesitate to engage.
India has the chance to lead by example. It can craft a privacy regime that is fair, flexible, and future-proof—one that balances individual rights with legitimate state interests, and innovation with accountability. This requires courage from lawmakers, vigilance from civil society, and responsibility from businesses. The crossroads is here: cling to exemptions and risk eroding trust, or legislate boldly to secure a balanced path forward. The time to decide is now.