{"id":34008,"date":"2026-10-12T08:23:01","date_gmt":"2026-10-12T08:23:01","guid":{"rendered":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/?p=34008"},"modified":"2026-10-12T08:25:52","modified_gmt":"2026-10-12T08:25:52","slug":"state-accountability-dpdp-act-2023","status":"publish","type":"post","link":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/","title":{"rendered":"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights"},"content":{"rendered":"\n<h1 id=\"h-state-accountability-under-the-digital-personal-data-protection-act-2023-constitutional-privacy-executive-power-and-the-limits-of-digital-governance\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"State_Accountability_under_the_Digital_Personal_Data_Protection_Act_2023_Constitutional_Privacy_Executive_Power_and_the_Limits_of_Digital_Governance\"><\/span>State Accountability under the Digital Personal Data Protection Act 2023: Constitutional Privacy, Executive Power and the Limits of Digital Governance<span class=\"ez-toc-section-end\"><\/span><\/h1>\n\n\n\n<h2 id=\"h-abstract\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Abstract\"><\/span>Abstract<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">India&#8217;s rapid transition towards digital governance has fundamentally changed how the State collects, processes, stores, and uses personal information. Biometric identification, digital welfare delivery, interconnected databases, and technology-enabled public administration have improved administrative efficiency while creating new concerns about privacy, transparency, and the concentration of governmental power. This article examines whether the Digital Personal Data Protection Act, 2023 (DPDP Act), read with the Digital Personal Data Protection Rules, 2025, provides adequate constitutional safeguards against the misuse of personal data by State authorities.<\/p><div id=\"ez-toc-container\" class=\"ez-toc-v2_0_88 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #0c0c0c;color:#0c0c0c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #0c0c0c;color:#0c0c0c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#State_Accountability_under_the_Digital_Personal_Data_Protection_Act_2023_Constitutional_Privacy_Executive_Power_and_the_Limits_of_Digital_Governance\" >State Accountability under the Digital Personal Data Protection Act 2023: Constitutional Privacy, Executive Power and the Limits of Digital Governance<\/a><ul class='ez-toc-list-level-2' ><li class='ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#Abstract\" >Abstract<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#1_Introduction\" >1. Introduction<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#2_Research_Problem_and_Questions\" >2. Research Problem and Questions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#3_Research_Objectives_and_Methodology\" >3. Research Objectives and Methodology<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#4_Constitutional_Foundations_of_Informational_Privacy\" >4. Constitutional Foundations of Informational Privacy<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#41_From_individual_liberty_to_informational_autonomy\" >4.1 From individual liberty to informational autonomy<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#42_The_constitutional_test_for_State_interference\" >4.2 The constitutional test for State interference<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#5_The_State_as_a_Custodian_of_Personal_Data\" >5. The State as a Custodian of Personal Data<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#6_The_Digital_Personal_Data_Protection_Act_2023_Structure_and_Constitutional_Concerns\" >6. The Digital Personal Data Protection Act, 2023: Structure and Constitutional Concerns<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#61_Section_7_and_the_scope_of_legitimate_uses\" >6.1 Section 7 and the scope of legitimate uses<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#62_Section_17_and_exemptions_for_State_instrumentalities\" >6.2 Section 17 and exemptions for State instrumentalities<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#63_Retention_access_and_the_limits_of_individual_rights\" >6.3 Retention, access, and the limits of individual rights<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#7_Regulatory_Independence_and_Executive_Oversight\" >7. Regulatory Independence and Executive Oversight<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#71_The_Data_Protection_Board_of_India\" >7.1 The Data Protection Board of India<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#72_Section_36_and_the_executives_power_to_require_information\" >7.2 Section 36 and the executive&#8217;s power to require information<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#8_The_Right_to_Information_Act_Amendment_Privacy_and_Public_Accountability\" >8. The Right to Information Act Amendment: Privacy and Public Accountability<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#9_Proportionality_in_Supreme_Court_Jurisprudence\" >9. Proportionality in Supreme Court Jurisprudence<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#91_Modern_Dental_College\" >9.1 Modern Dental College<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#92_The_Aadhaar_judgment\" >9.2 The Aadhaar judgment<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#93_Anuradha_Bhasin_and_reasoned_decision-making\" >9.3 Anuradha Bhasin and reasoned decision-making<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#94_Surveillance_and_independent_safeguards\" >9.4 Surveillance and independent safeguards<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#10_Recent_Developments_Implementation_and_Constitutional_Challenges_in_2026\" >10. Recent Developments: Implementation and Constitutional Challenges in 2026<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#101_Notification_of_the_Digital_Personal_Data_Protection_Rules_2025\" >10.1 Notification of the Digital Personal Data Protection Rules, 2025<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#102_Supreme_Court_challenges_to_the_DPDP_framework\" >10.2 Supreme Court challenges to the DPDP framework<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#103_Why_implementation_and_litigation_must_be_considered_together\" >10.3 Why implementation and litigation must be considered together<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#11_Comparative_Perspective_Lessons_from_European_Union_Law\" >11. Comparative Perspective: Lessons from European Union Law<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#12_Findings_and_Critical_Observations\" >12. Findings and Critical Observations<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#13_Recommendations_for_Strengthening_State_Accountability\" >13. Recommendations for Strengthening State Accountability<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-30\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#131_Narrow_and_justify_exemptions\" >13.1 Narrow and justify exemptions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-31\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#132_Strengthen_independent_oversight\" >13.2 Strengthen independent oversight<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-32\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#133_Require_documented_proportionality_assessments\" >13.3 Require documented proportionality assessments<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-33\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#134_Establish_clear_retention_and_deletion_standards\" >13.4 Establish clear retention and deletion standards<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-34\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#135_Protect_the_public_interest_in_transparency\" >13.5 Protect the public interest in transparency<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-35\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#136_Improve_public-sector_accountability_and_remedies\" >13.6 Improve public-sector accountability and remedies<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-36\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#14_Conclusion\" >14. Conclusion<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n\n\n\n<p class=\"wp-block-paragraph\">Drawing on doctrinal legal research, constitutional provisions, statutory interpretation, and Supreme Court jurisprudence, the article evaluates the relationship between informational privacy and governmental accountability. Particular attention is given to the legitimate-use provisions under Section 7, the exemptions available to State instrumentalities under Section 17, the institutional design of the Data Protection Board of India, the Central Government&#8217;s information-gathering powers under Section 36, and the amendment to the Right to Information Act, 2005, introduced by Section 44(3) of the DPDP Act.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The article argues that the effectiveness of India&#8217;s data protection framework must be assessed not merely by the obligations it imposes on private organisations, but also by the safeguards it provides against the exercise of State power. Broad exemptions, executive influence over regulatory institutions, and the reduced scope for balancing privacy against public interest raise important questions under Articles 14, 19 and 21 of the Constitution. Recent constitutional challenges before the Supreme Court further demonstrate the significance of these concerns. The article concludes that meaningful State accountability under the Digital Personal Data Protection Act 2023 requires narrowly tailored exemptions, independent oversight, transparent decision-making, and effective remedies against unlawful or disproportionate data processing.<\/p>\n\n\n\n<h2 id=\"h-1-introduction\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Introduction\"><\/span>1. Introduction<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Digital technology has become an integral part of governance in India. Citizens increasingly access welfare benefits, identity verification, public services, and administrative facilities through digital systems. Government departments rely on interconnected databases, biometric authentication, and large-scale information processing to identify beneficiaries, distribute subsidies, detect irregularities, and administer public programmes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These developments have considerable potential. Digital systems can reduce administrative delays, improve service delivery, and make public institutions more responsive. However, the same systems also enable the State to collect and combine information about individuals on a scale that was difficult to imagine in an entirely paper-based administrative environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional challenge is therefore not simply whether the government should use digital technology. It is whether the collection and use of personal information remain subject to meaningful legal limits, independent scrutiny, and effective remedies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The concern becomes particularly significant when access to essential services depends on the disclosure or verification of personal information. A citizen seeking a welfare benefit may have little practical choice but to submit biometric or demographic data. In such circumstances, consent cannot always be understood as a genuinely voluntary decision. The relationship between the individual and the State is unequal, and the consequences of refusing to participate in a digital system may be substantial.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Supreme Court&#8217;s landmark decision in <em>Justice K.S. Puttaswamy (Retd.) v Union of India<\/em> (2017) established that privacy is a fundamental right protected by the Constitution. The judgment recognised informational privacy as an important dimension of individual autonomy and affirmed that State interference with privacy must satisfy the requirements of legality, legitimate purpose, and proportionality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Parliament subsequently enacted the Digital Personal Data Protection Act, 2023. The Central Government notified the Digital Personal Data Protection Rules, 2025, in November 2025, establishing the framework for implementing the legislation through a phased commencement schedule.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The introduction of this framework represents an important development in Indian data protection law. Nevertheless, the existence of a statutory regime does not, by itself, establish that the State is adequately accountable for its handling of personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A central difficulty lies in the difference between regulating private organisations and regulating government agencies. Private entities generally operate within a framework of notice, consent, specified legitimate uses, security obligations, and penalties. Government agencies, by contrast, exercise statutory powers, deliver essential services, maintain public databases, and may invoke national security or other public interests to justify exemptions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This distinction raises the principal question examined in this article: <strong>Does the Digital Personal Data Protection Act, 2023, read with the Rules of 2025, provide sufficient safeguards to ensure that State processing of personal data remains consistent with constitutional privacy and the rule of law?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The article argues that the framework has made meaningful progress in recognising data protection as a matter of public importance, but its approach to State accountability remains open to serious constitutional scrutiny. The decisive issue is whether governmental access to personal information is governed by clear legal standards, proportionate restrictions, independent supervision, and effective remedies.<\/p>\n\n\n\n<h2 id=\"h-2-research-problem-and-questions\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Research_Problem_and_Questions\"><\/span>2. Research Problem and Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The central research problem is the gap that may exist between the constitutional protection of informational privacy and the statutory arrangements governing State access to personal data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Constitution does not prohibit every form of governmental data collection. Public authorities must be able to process information when administering welfare programmes, enforcing the law, maintaining public records, or responding to legitimate security concerns. However, the existence of a public purpose does not automatically justify every method of collecting, retaining, or sharing personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional difficulty arises when legislation gives the executive broad discretion to determine which agencies may be exempted from data protection obligations, permits extensive processing without fresh consent, or places regulatory institutions under substantial governmental influence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three questions guide the analysis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, what constitutional standards govern the collection and processing of personal data by public authorities?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, do the exemptions, enforcement mechanisms, and institutional arrangements established under the DPDP Act satisfy the constitutional requirements of legality, legitimate purpose, and proportionality?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Third, what legislative and institutional reforms could strengthen State accountability under the Digital Personal Data Protection Act 2023 without unnecessarily obstructing legitimate public administration?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These questions are considered through an examination of constitutional jurisprudence, statutory provisions, and comparative legal principles.<\/p>\n\n\n\n<h2 id=\"h-3-research-objectives-and-methodology\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"3_Research_Objectives_and_Methodology\"><\/span>3. Research Objectives and Methodology<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This article adopts a doctrinal legal research methodology. It examines authoritative legal materials, interprets relevant statutory provisions, and evaluates their compatibility with established constitutional principles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The primary sources include the Constitution of India, the DPDP Act, the Digital Personal Data Protection Rules, 2025, the Aadhaar Act, 2016, the Right to Information Act, 2005, and relevant Supreme Court decisions. Secondary materials include the Justice B.N. Srikrishna Committee&#8217;s report and scholarly writing on privacy, digital governance, and institutional accountability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">European Union data protection law is used as a comparative reference rather than as binding authority in India.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The analysis is normative as well as interpretative. It identifies the constitutional standards emerging from judicial decisions and assesses whether the statutory framework adequately reflects those standards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An important limitation must be acknowledged. The substantive DPDP compliance regime is being implemented in phases. As of 12 October 2026, the principal compliance obligations are not yet scheduled to take effect until May 2027. Consequently, the article evaluates the legal design and anticipated operation of the framework rather than claiming to establish its practical effectiveness through empirical evidence.<\/p>\n\n\n\n<h2 id=\"h-4-constitutional-foundations-of-informational-privacy\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"4_Constitutional_Foundations_of_Informational_Privacy\"><\/span>4. Constitutional Foundations of Informational Privacy<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 id=\"h-4-1-from-individual-liberty-to-informational-autonomy\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"41_From_individual_liberty_to_informational_autonomy\"><\/span>4.1 From individual liberty to informational autonomy<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional understanding of privacy in India developed gradually.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In <em>M.P. Sharma v Satish Chandra<\/em> (1954), the Supreme Court declined to recognise a general constitutional right to privacy in the context of search and seizure. In <em>Kharak Singh v State of Uttar Pradesh<\/em> (1962), the Court invalidated certain forms of domiciliary surveillance while the majority did not accept a general fundamental right to privacy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Later decisions moved towards a more protective understanding of personal liberty. In <em>Gobind v State of Madhya Pradesh<\/em> (1975), the Court acknowledged privacy interests subject to constitutional limitations. <em>Maneka Gandhi v Union of India<\/em> (1978) further established that a procedure affecting personal liberty must be fair, just, and reasonable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional position was decisively clarified in <em>Justice K.S. Puttaswamy (Retd.) v Union of India<\/em> (2017). A nine-judge Bench unanimously recognised privacy as a fundamental right under Article 21 and the freedoms guaranteed by Part III of the Constitution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The judgment also recognised that privacy encompasses the individual&#8217;s interest in controlling personal information. This is especially important in a society where digital systems can combine information from multiple sources to construct detailed profiles of individuals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Informational privacy is not confined to preventing the disclosure of secrets. It also concerns the purposes for which information is collected, the persons who may access it, the period for which it is retained, and the consequences of combining it with other data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional significance is clear: information initially collected for a limited administrative purpose should not automatically become available for every other governmental purpose.<\/p>\n\n\n\n<h3 id=\"h-4-2-the-constitutional-test-for-state-interference\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"42_The_constitutional_test_for_State_interference\"><\/span>4.2 The constitutional test for State interference<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The <em>Puttaswamy<\/em> judgment established that an infringement of privacy must satisfy three essential requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>First, legality:<\/strong> State interference must have a valid legal basis. Executive convenience or an informal administrative practice cannot independently justify an intrusion into a fundamental right.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Second, legitimate purpose:<\/strong> The measure must pursue an objective that the Constitution permits the State to pursue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Third, proportionality:<\/strong> The interference must bear a reasonable relationship to the objective, must not impose a greater restriction than necessary, and must maintain an appropriate balance between public interests and individual rights.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These requirements are connected. A legitimate objective cannot cure the absence of adequate legal safeguards. Similarly, the existence of statutory authority does not establish that every exercise of that authority is necessary or proportionate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Supreme Court&#8217;s subsequent decisions have reinforced the importance of procedural safeguards, reasoned decisions, and judicial review when the State restricts fundamental rights.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For digital governance, this means that a government agency should be able to explain not only why it needs particular information, but also why the amount of information collected, the duration of retention, and the conditions of access are justified.<\/p>\n\n\n\n<h2 id=\"h-5-the-state-as-a-custodian-of-personal-data\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"5_The_State_as_a_Custodian_of_Personal_Data\"><\/span>5. The State as a Custodian of Personal Data<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The relationship between the State and personal information differs in important respects from the relationship between a commercial organisation and its customers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A private organisation may request information to provide a service, and an individual may sometimes choose an alternative provider. A citizen dealing with a public authority may have no comparable alternative, particularly when the information is required to access welfare benefits, public records, identity services, or statutory entitlements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This imbalance makes it difficult to treat consent as the sole foundation of legitimate State processing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A person may formally agree to data collection because refusing would jeopardise access to an essential service. Although the consent mechanism may satisfy a procedural requirement, the circumstances do not necessarily demonstrate meaningful freedom of choice.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The better approach is to recognise that public authorities have responsibilities that extend beyond obtaining consent. They must establish a lawful purpose, collect only the information reasonably required, protect it against unauthorised access, and ensure that subsequent use remains within legally defensible limits.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These responsibilities are consistent with the broader idea that institutions entrusted with personal information should exercise that power in the interests of the people whose information they hold.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">State accountability in digital governance can therefore be understood through three interconnected dimensions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Substantive accountability<\/strong> requires data processing to be lawful, necessary, purpose-specific, and proportionate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Procedural accountability<\/strong> requires appropriate notice, recorded reasons where necessary, fair processes, and opportunities to challenge unlawful decisions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Institutional accountability<\/strong> requires effective supervision by bodies capable of examining governmental conduct independently and ensuring compliance with constitutional standards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A framework that protects personal information only against commercial misuse, while leaving comparable governmental processing subject to weak or opaque safeguards, cannot provide complete protection for informational privacy.<\/p>\n\n\n\n<h2 id=\"h-6-the-digital-personal-data-protection-act-2023-structure-and-constitutional-concerns\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"6_The_Digital_Personal_Data_Protection_Act_2023_Structure_and_Constitutional_Concerns\"><\/span>6. The Digital Personal Data Protection Act, 2023: Structure and Constitutional Concerns<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The DPDP Act establishes a statutory framework for processing digital personal data. It recognises obligations for entities known as Data Fiduciaries and provides rights and duties for individuals, described as Data Principals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The legislation addresses important aspects of data governance, including consent, specified legitimate uses, security, individual rights, and regulatory enforcement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, its constitutional implications cannot be assessed by examining its general protections alone. Particular attention must be given to provisions governing State processing and exemptions.<\/p>\n\n\n\n<h3 id=\"h-6-1-section-7-and-the-scope-of-legitimate-uses\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"61_Section_7_and_the_scope_of_legitimate_uses\"><\/span>6.1 Section 7 and the scope of legitimate uses<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Section 7 identifies circumstances in which personal data may be processed without obtaining consent under the ordinary consent framework.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These include specified situations involving the provision of subsidies, benefits, services, certificates, licences, and permits by the State, subject to the statutory conditions. The provision also addresses the performance of functions under law and other specified circumstances.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are legitimate reasons for permitting certain public functions to operate without requiring fresh consent for every instance of processing. Welfare administration, law enforcement, and the performance of statutory responsibilities cannot always depend on an individual&#8217;s continuing approval.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nevertheless, a distinction must be drawn between permitting necessary processing and authorising unrestricted reuse of existing information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A database originally created to administer a welfare scheme may contain information that could be useful for other governmental activities. Its technical availability does not establish that every subsequent use is legally justified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional concern is therefore one of purpose limitation and proportionality. Public authorities should be required to demonstrate that a proposed use is connected to a lawful function and that the nature and extent of the processing are justified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The existence of information in a government database should not become a general permission to use it for unrelated purposes.<\/p>\n\n\n\n<h3 id=\"h-6-2-section-17-and-exemptions-for-state-instrumentalities\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"62_Section_17_and_exemptions_for_State_instrumentalities\"><\/span>6.2 Section 17 and exemptions for State instrumentalities<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Section 17 provides exemptions from specified requirements of the Act in defined circumstances. Section 17(2)(a), in particular, empowers the Central Government to exempt State instrumentalities by notification on specified grounds, including matters associated with national security and public order.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some exemptions are necessary. Government agencies may need to protect intelligence sources, maintain the confidentiality of ongoing investigations, or prevent the disclosure of information that would compromise legitimate security operations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional question is not whether exemptions should exist, but how narrowly they should be framed and how their use should be supervised.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A broad exemption affecting an entire agency can have consequences extending beyond the particular activity that originally justified it. An authority may have legitimate grounds to withhold information about a sensitive investigation without having any corresponding justification for relaxing basic data security or retaining unrelated personal information indefinitely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The distinction matters because different obligations serve different purposes. Confidentiality may be necessary in one context, while security safeguards, internal controls, and limits on retention remain essential.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A proportionate framework would therefore distinguish between particular processing activities and an agency&#8217;s general status. Exemptions should be tailored to identified risks rather than treated as a blanket solution to every operational concern.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The statutory design also raises questions about the criteria governing executive decisions. Where an exemption has a substantial effect on fundamental rights, the law should provide adequate guidance, require appropriate reasons, and permit independent review.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Without such safeguards, broad discretionary powers may create uncertainty and increase the risk of arbitrary treatment under Article 14.<\/p>\n\n\n\n<h3 id=\"h-6-3-retention-access-and-the-limits-of-individual-rights\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"63_Retention_access_and_the_limits_of_individual_rights\"><\/span>6.3 Retention, access, and the limits of individual rights<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Section 17(4) provides additional flexibility concerning specified obligations relating to the retention and erasure of personal data by the State.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There may be sound reasons to preserve particular records. Public authorities have obligations involving audits, financial accountability, legal proceedings, and the maintenance of official archives.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the need to preserve some records does not establish a general justification for indefinite retention of all personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Data retained beyond its original purpose increases the period during which it may be accessed, combined, disclosed, or misused. Excessive retention also makes it harder to ensure that information remains accurate and relevant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A defensible retention policy should identify the applicable purpose, the legal requirement for preservation, and the point at which continued retention ceases to be justified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same reasoning applies to individual rights. Where the law restricts access, correction, or erasure, the restriction should be connected to a specific and defensible public interest. It should not automatically remove accountability simply because the information is held by a government body.<\/p>\n\n\n\n<h2 id=\"h-7-regulatory-independence-and-executive-oversight\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"7_Regulatory_Independence_and_Executive_Oversight\"><\/span>7. Regulatory Independence and Executive Oversight<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 id=\"h-7-1-the-data-protection-board-of-india\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"71_The_Data_Protection_Board_of_India\"><\/span>7.1 The Data Protection Board of India<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An effective data protection regime requires an institution capable of enforcing legal obligations and addressing complaints about non-compliance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The DPDP Act establishes the Data Protection Board of India. Its effectiveness will depend not only on its statutory powers, but also on its institutional independence, expertise, resources, and ability to act impartially.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sections 18 and 19 govern important aspects of the Board&#8217;s constitution and appointment arrangements. The statutory framework places a significant role in appointments in the hands of the Central Government, while the Act provides for relatively short terms and the possibility of reappointment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These arrangements raise a legitimate institutional question: can a regulator be expected to scrutinise State data processing confidently if its leadership depends substantially on the executive it may be required to examine?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Executive involvement in appointments does not, by itself, establish that a regulator will act improperly. The constitutional concern is whether the overall institutional design provides sufficient safeguards against actual or perceived dependence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regulatory independence matters most when the subject of scrutiny is the government itself. A body that primarily disciplines private organisations but lacks practical independence when dealing with public authorities may provide an incomplete form of accountability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A stronger institutional framework would include transparent appointment procedures, clearly defined qualifications, secure tenure, adequate resources, and safeguards against arbitrary removal or interference.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where decisions affect fundamental rights, meaningful opportunities for independent judicial scrutiny are equally important.<\/p>\n\n\n\n<h3 id=\"h-7-2-section-36-and-the-executive-s-power-to-require-information\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"72_Section_36_and_the_executives_power_to_require_information\"><\/span>7.2 Section 36 and the executive&#8217;s power to require information<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Section 36 empowers the Central Government to call for information from the Board or a Data Fiduciary in specified circumstances.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Information-gathering powers can be essential for administration and regulatory coordination. The difficulty arises when the exercise of such powers may affect confidential information, regulatory independence, or the willingness of institutions to scrutinise governmental conduct.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A sound legal framework should distinguish between obtaining information for legitimate oversight and using information-gathering authority in a manner that interferes with independent adjudication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The relevant safeguards include clear limits on the information that may be demanded, defined purposes, appropriate confidentiality protections, and a mechanism for reviewing disputed directions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional question is one of institutional balance. Executive accountability should not come at the expense of the independence required for effective regulation.<\/p>\n\n\n\n<h2 id=\"h-8-the-right-to-information-act-amendment-privacy-and-public-accountability\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"8_The_Right_to_Information_Act_Amendment_Privacy_and_Public_Accountability\"><\/span>8. The Right to Information Act Amendment: Privacy and Public Accountability<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most consequential aspects of the DPDP Act is Section 44(3), which amends Section 8(1)(j) of the Right to Information Act, 2005.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before the amendment, the RTI framework contained language that permitted a balancing exercise involving personal information, privacy, and the larger public interest. The amendment replaced that formulation with a broader exemption for information relating to personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The change has raised concerns about the relationship between the right to privacy and the public&#8217;s right to know how government functions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Privacy is an important constitutional interest. Public authorities should not disclose personal information merely because it has been requested under the RTI Act. Unnecessary disclosure can expose individuals to harassment, discrimination, identity theft, and other forms of harm.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, transparency also serves an essential democratic purpose. Information about public appointments, expenditure, administrative decisions, and the exercise of official power can be necessary to identify corruption, conflicts of interest, favouritism, and misuse of public resources.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The challenge is to distinguish information that genuinely protects an individual&#8217;s private life from information whose disclosure is necessary to scrutinise public conduct.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, personal medical details ordinarily deserve strong protection. Information about the expenditure of public funds or the exercise of official authority may raise different considerations, even when some personal information is involved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A system that does not adequately distinguish these situations risks treating privacy as an automatic answer to requests that concern public accountability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional significance extends beyond the operation of a single statute. The right to information has been linked by the Supreme Court to freedom of speech and expression under Article 19(1)(a). Restrictions on access to official information must therefore be assessed in light of both privacy and democratic transparency.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The objective should not be to subordinate one right to the other. It should be to develop a legal framework that protects personal information while preserving reasonable opportunities to examine the exercise of public power.<\/p>\n\n\n\n<h2 id=\"h-9-proportionality-in-supreme-court-jurisprudence\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"9_Proportionality_in_Supreme_Court_Jurisprudence\"><\/span>9. Proportionality in Supreme Court Jurisprudence<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional assessment of the DPDP framework must be informed by the Supreme Court&#8217;s broader jurisprudence on proportionality.<\/p>\n\n\n\n<h3 id=\"h-9-1-modern-dental-college\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"91_Modern_Dental_College\"><\/span>9.1 Modern Dental College<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In <em>Modern Dental College and Research Centre v State of Madhya Pradesh<\/em> (2016), the Supreme Court articulated a structured approach to proportionality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The analysis considers whether a measure pursues a legitimate objective, whether it is rationally connected to that objective, whether a less restrictive but equally effective alternative is available, and whether the measure strikes an appropriate balance between the public interest and the rights affected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Applied to data protection, this approach requires more than identifying a legitimate governmental function. It requires an examination of whether the particular processing arrangement is reasonably necessary to perform that function.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If a limited disclosure would meet the government&#8217;s needs, unrestricted access to an entire database may be difficult to justify. If withholding notice is necessary to protect an investigation, that does not automatically establish a need to remove unrelated security obligations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Proportionality thus encourages a more precise relationship between public purposes and the restrictions imposed on individual privacy.<\/p>\n\n\n\n<h3 id=\"h-9-2-the-aadhaar-judgment\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"92_The_Aadhaar_judgment\"><\/span>9.2 The Aadhaar judgment<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In <em>Justice K.S. Puttaswamy (Retd.) v Union of India<\/em> (2019), commonly known as the Aadhaar judgment, the Supreme Court considered the constitutional validity of the Aadhaar framework.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The majority upheld important aspects of Aadhaar&#8217;s use for welfare delivery while invalidating or restricting particular provisions, including the broad private-use provision under Section 57 of the Aadhaar Act and the national-security disclosure mechanism under Section 33(2).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Court&#8217;s treatment of disclosure safeguards demonstrated that the legitimacy of a digital identification system does not remove the need for limits on access to sensitive information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The decision is relevant because it recognises that digital infrastructure can serve legitimate public objectives while still requiring carefully defined restrictions and procedural protections.<\/p>\n\n\n\n<h3 id=\"h-9-3-anuradha-bhasin-and-reasoned-decision-making\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"93_Anuradha_Bhasin_and_reasoned_decision-making\"><\/span>9.3 Anuradha Bhasin and reasoned decision-making<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In <em>Anuradha Bhasin v Union of India<\/em> (2020), the Supreme Court considered restrictions on internet access in Jammu and Kashmir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The judgment emphasised the importance of publishing relevant orders, providing reasons for restrictions, ensuring judicial review, and preventing indefinite restrictions without appropriate review.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Although the case concerned internet restrictions rather than a general data protection regime, its procedural principles remain relevant to digital governance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Government decisions affecting fundamental rights should not be insulated from scrutiny merely because they involve technology or administrative security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Transparency about the legal basis of a restriction, subject to legitimate confidentiality requirements, helps ensure that executive discretion remains within constitutional boundaries.<\/p>\n\n\n\n<h3 id=\"h-9-4-surveillance-and-independent-safeguards\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"94_Surveillance_and_independent_safeguards\"><\/span>9.4 Surveillance and independent safeguards<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In <em>People&#8217;s Union for Civil Liberties v Union of India<\/em> (1997), the Supreme Court addressed telephone interception and required procedural safeguards against arbitrary intrusion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Similarly, in <em>Manohar Lal Sharma v Union of India<\/em> (2021), concerning allegations of the use of Pegasus spyware, the Court rejected the proposition that invoking national security automatically excludes judicial review and established an expert technical committee to examine the allegations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These decisions support an important constitutional principle: security concerns deserve serious consideration, but they do not create an unlimited area of executive discretion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same principle should inform the interpretation of the DPDP Act. Where the State invokes security or public order to justify access to personal data, the legal framework should provide safeguards appropriate to the sensitivity of the information and the nature of the intrusion.<\/p>\n\n\n\n<h2 id=\"h-10-recent-developments-implementation-and-constitutional-challenges-in-2026\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"10_Recent_Developments_Implementation_and_Constitutional_Challenges_in_2026\"><\/span>10. Recent Developments: Implementation and Constitutional Challenges in 2026<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The legal position has developed significantly since the DPDP Act was enacted in 2023.<\/p>\n\n\n\n<h3 id=\"h-10-1-notification-of-the-digital-personal-data-protection-rules-2025\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"101_Notification_of_the_Digital_Personal_Data_Protection_Rules_2025\"><\/span>10.1 Notification of the Digital Personal Data Protection Rules, 2025<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Central Government notified the Digital Personal Data Protection Rules, 2025, in November 2025. The Rules provide the implementation framework for several obligations under the Act, including requirements relating to notice, consent, security, data retention, and the exercise of individual rights.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the framework is being brought into operation in phases rather than through a single commencement date.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As of 12 October 2026, the statutory timeline provides for the Consent Manager-related provisions to take effect one year after publication of the commencement notification, corresponding to 13 November 2026. The principal substantive obligations are scheduled to commence 18 months after publication, corresponding to 13 May 2027. These dates follow the published commencement notifications and should be distinguished from any subsequent legal or administrative changes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The phased approach gives organisations time to prepare for compliance. It also means that the practical effectiveness of the substantive framework cannot yet be judged conclusively.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For State accountability, the important issue is whether the transition period is used to develop clear procedures, strengthen security, define responsibilities, and establish effective mechanisms for handling complaints.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The notification of the Rules is an important implementation milestone, but the quality of protection will ultimately depend on how the statutory framework operates in practice.<\/p>\n\n\n\n<h3 id=\"h-10-2-supreme-court-challenges-to-the-dpdp-framework\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"102_Supreme_Court_challenges_to_the_DPDP_framework\"><\/span>10.2 Supreme Court challenges to the DPDP framework<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutionality of several provisions of the DPDP Act and the 2025 Rules has become the subject of proceedings before the Supreme Court of India in 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In <em>Venkatesh Nayak v Union of India<\/em>, Writ Petition (Civil) No. 177 of 2026, and connected proceedings, petitioners have challenged aspects of the legislation on constitutional grounds involving Articles 14, 19(1)(a), and 21.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The challenges concern, among other matters, the amendment to the RTI Act, the scope of State exemptions, the powers of the executive, and the independence of the regulatory framework.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On 16 February 2026, the Supreme Court issued notice in the proceedings and declined to grant an interim stay at that stage. On 7 August 2026, the Court considered arguments concerning the implications of the RTI amendment for investigative journalism and public access to information, while seeking the Central Government&#8217;s response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As of 12 October 2026, the material available for this article does not establish that the challenged provisions have been struck down or suspended. The constitutional issues therefore remain important questions for judicial determination.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These proceedings should not be treated as proof that the legislation is unconstitutional. They do, however, demonstrate that the relationship between privacy, transparency, executive discretion, and regulatory independence requires careful judicial examination.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The challenge involving Section 44(3) is particularly significant because it raises a broader question about the relationship between two constitutional values: the protection of personal information and the public&#8217;s ability to scrutinise government conduct.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Court&#8217;s eventual consideration of these questions may have implications extending beyond data protection law. It may also help clarify the standards that apply when Parliament changes the statutory balance between privacy and access to public information.<\/p>\n\n\n\n<h3 id=\"h-10-3-why-implementation-and-litigation-must-be-considered-together\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"103_Why_implementation_and_litigation_must_be_considered_together\"><\/span>10.3 Why implementation and litigation must be considered together<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The phased commencement of the DPDP framework and the pending constitutional challenges create two parallel developments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first concerns implementation: public authorities and private organisations must prepare for the obligations that will become applicable under the statutory schedule.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second concerns constitutional interpretation: the courts must determine whether challenged provisions are consistent with fundamental rights.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Neither development should be ignored.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Compliance planning cannot assume that every contested provision will necessarily survive constitutional scrutiny without modification. Equally, the existence of pending litigation does not mean that the framework should be treated as suspended.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For policymakers, the practical lesson is that legal certainty, institutional independence, and clearly defined safeguards are essential to a durable data protection regime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For citizens, the central question remains whether the law provides effective protection when personal information is collected or used by the State itself.<\/p>\n\n\n\n<h2 id=\"h-11-comparative-perspective-lessons-from-european-union-law\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"11_Comparative_Perspective_Lessons_from_European_Union_Law\"><\/span>11. Comparative Perspective: Lessons from European Union Law<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The European Union&#8217;s General Data Protection Regulation (GDPR) offers a useful comparative framework for assessing restrictions on individual data protection rights.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Article 23 of the GDPR permits certain restrictions for specified objectives, including national security and public interests. Such restrictions must be established through legislative measures and comply with requirements of necessity, proportionality, and respect for the essence of fundamental rights.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The significance of this approach lies in its insistence that public interest does not automatically justify unrestricted interference with personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Court of Justice of the European Union reinforced the importance of effective safeguards in <em>Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems<\/em> (Schrems II, 2020). The judgment invalidated the EU-US Privacy Shield arrangement in the context of concerns about access to personal data by United States public authorities and the availability of effective remedies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The European framework does not provide a model that India must reproduce in every detail. India&#8217;s constitutional structure, administrative requirements, and institutional circumstances differ.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nevertheless, it demonstrates that security-related exceptions can coexist with data protection when they are sufficiently defined, subject to necessity and proportionality, and accompanied by meaningful avenues of redress.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For India, the relevant lesson is that exemptions should not operate as unrestricted permissions. Their scope should correspond to the particular public interest being protected, and the legal framework should preserve safeguards wherever those safeguards do not undermine the legitimate objective.<\/p>\n\n\n\n<h2 id=\"h-12-findings-and-critical-observations\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"12_Findings_and_Critical_Observations\"><\/span>12. Findings and Critical Observations<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The analysis supports five principal findings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>First, the constitutional protection of privacy is well established.<\/strong> The Supreme Court has recognised privacy as a fundamental right and developed standards governing State interference. Digital governance must therefore operate within the constitutional framework of legality, legitimate purpose, and proportionality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Second, the DPDP framework adopts an uneven approach to public and private data processing.<\/strong> The Act establishes important obligations for Data Fiduciaries, but its legitimate-use provisions and State exemptions raise questions about whether public authorities are subject to sufficiently precise and independently enforceable safeguards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Third, the breadth of State exemptions requires careful scrutiny.<\/strong> National security, public order, and the administration of welfare schemes are legitimate governmental concerns. However, their legitimacy does not establish that every exemption is necessary or that an entire agency should be relieved of obligations unrelated to the specific risk being addressed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Fourth, institutional independence is essential to credible enforcement.<\/strong> The Data Protection Board must be capable of applying the law impartially, including in matters involving governmental bodies. Transparent appointments, secure tenure, adequate resources, and effective judicial review would strengthen public confidence in the regulatory system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Fifth, privacy protection and transparency must be reconciled rather than treated as competing absolutes.<\/strong> The amendment to the RTI Act raises significant concerns about the ability of citizens and journalists to obtain information needed to scrutinise public administration. The constitutional balance should protect genuinely private information without unnecessarily shielding the exercise of public power from accountability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Taken together, these findings indicate that the adequacy of the DPDP framework cannot be assessed solely by reference to the number of obligations it imposes or the penalties it authorises. Its constitutional legitimacy also depends on the extent to which governmental discretion is constrained and meaningful remedies remain available.<\/p>\n\n\n\n<h2 id=\"h-13-recommendations-for-strengthening-state-accountability\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"13_Recommendations_for_Strengthening_State_Accountability\"><\/span>13. Recommendations for Strengthening State Accountability<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A more constitutionally robust framework can be developed without preventing the State from performing legitimate public functions.<\/p>\n\n\n\n<h3 id=\"h-13-1-narrow-and-justify-exemptions\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"131_Narrow_and_justify_exemptions\"><\/span>13.1 Narrow and justify exemptions<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Exemptions should be limited to the particular purposes and processing activities that genuinely require them. Where possible, the law should distinguish between withholding information from an individual, retaining information for a statutory purpose, and maintaining basic security safeguards.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Central Government should provide reasons for exemption decisions, subject to necessary protections for sensitive information. Periodic review would help determine whether an exemption remains justified.<\/p>\n\n\n\n<h3 id=\"h-13-2-strengthen-independent-oversight\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"132_Strengthen_independent_oversight\"><\/span>13.2 Strengthen independent oversight<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Data Protection Board&#8217;s appointment and operational arrangements should provide meaningful safeguards against executive influence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Transparent selection criteria, professional expertise, appropriate tenure protections, and adequate resources would improve institutional credibility. Decisions involving constitutional rights should remain subject to effective judicial review.<\/p>\n\n\n\n<h3 id=\"h-13-3-require-documented-proportionality-assessments\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"133_Require_documented_proportionality_assessments\"><\/span>13.3 Require documented proportionality assessments<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Government agencies should assess the necessity and proportionality of significant personal-data processing activities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Such assessments should identify the legal basis, the public objective, the categories of information involved, the anticipated risks, and the safeguards available. Less intrusive alternatives should be considered where they could achieve the same legitimate purpose.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This approach would make constitutional scrutiny more concrete and reduce the risk that broad references to administrative efficiency or security become sufficient justification for extensive data collection.<\/p>\n\n\n\n<h3 id=\"h-13-4-establish-clear-retention-and-deletion-standards\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"134_Establish_clear_retention_and_deletion_standards\"><\/span>13.4 Establish clear retention and deletion standards<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Public authorities should adopt retention schedules that reflect statutory obligations and legitimate administrative needs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Where data must be retained for legal or archival reasons, the basis and duration of retention should be documented. Where the original purpose has ended and no valid retention ground remains, continued storage should be reconsidered.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The objective is not indiscriminate deletion, but the prevention of unnecessary accumulation of personal information.<\/p>\n\n\n\n<h3 id=\"h-13-5-protect-the-public-interest-in-transparency\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"135_Protect_the_public_interest_in_transparency\"><\/span>13.5 Protect the public interest in transparency<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The legal framework governing RTI requests should preserve a meaningful distinction between private personal information and information necessary to scrutinise public administration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Any applicable public-interest balancing mechanism should be sufficiently clear to protect individual privacy while permitting appropriate disclosure relating to public expenditure, official conduct, conflicts of interest, and administrative decision-making.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Safeguards against misuse of personal information should not become a general barrier to legitimate investigative journalism or democratic oversight.<\/p>\n\n\n\n<h3 id=\"h-13-6-improve-public-sector-accountability-and-remedies\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"136_Improve_public-sector_accountability_and_remedies\"><\/span>13.6 Improve public-sector accountability and remedies<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Individuals should have accessible channels for raising concerns about the collection, use, disclosure, and retention of their personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Public authorities should maintain appropriate records of data-processing activities, investigate breaches, and ensure that complaints are handled fairly. Where the statutory framework restricts an individual&#8217;s rights for legitimate reasons, an appropriate independent mechanism should be available to review the restriction.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These measures would help translate constitutional principles into administrative practices that can be examined and enforced.<\/p>\n\n\n\n<h2 id=\"h-14-conclusion\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"14_Conclusion\"><\/span>14. Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">India&#8217;s digital transformation has made the collection and use of personal information an essential feature of modern governance. Digital identification, welfare delivery, public databases, and technology-enabled administration can improve the delivery of services, but they also increase the State&#8217;s capacity to monitor individuals and combine information across different contexts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The constitutional challenge is to ensure that this capacity remains subject to law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Supreme Court&#8217;s privacy jurisprudence establishes that governmental interference with personal information must satisfy the requirements of legality, legitimate purpose, and proportionality. These principles apply not only when the State collects information, but also when it retains, shares, discloses, or repurposes that information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Digital Personal Data Protection Act, 2023, and the Rules notified in 2025 represent an important step towards a comprehensive statutory framework. However, the breadth of State exemptions, the institutional design of the Data Protection Board, the executive&#8217;s information-gathering powers, and the amendment to the Right to Information Act raise questions about the strength of the safeguards available against governmental overreach.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Supreme Court proceedings concerning the DPDP framework in 2026 have brought these questions into sharper focus. Their significance lies not in any assumption about the eventual outcome, but in the constitutional issues they place before the Court: how privacy should be protected, how executive discretion should be constrained, and how transparency can be preserved in a digital democracy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ultimately, <strong>State accountability under the Digital Personal Data Protection Act 2023<\/strong> must be measured by more than the existence of legislation or the formal recognition of individual rights. It depends on whether the State can justify its use of personal information, whether its powers are appropriately limited, and whether independent institutions can examine its decisions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A constitutionally credible data protection regime must protect individuals against unnecessary intrusion without disabling legitimate public administration. It must also recognise that the State&#8217;s responsibility is greater, not lesser, when citizens have limited practical control over the information they are required to provide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The way forward lies in narrowly defined exemptions, independent oversight, proportionate data processing, transparent decision-making, and effective remedies. These safeguards would help ensure that digital governance remains a means of serving citizens rather than an instrument of unchecked informational power.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The enduring constitutional principle is straightforward: technological capacity does not create unlimited legal authority. In a democratic republic, the State&#8217;s ability to know more about its citizens must be matched by its obligation to explain, justify, and submit its exercise of power to meaningful scrutiny.<\/p>\n\n\n\n<ul class=\"wp-block-yoast-seo-related-links yoast-seo-related-links\">\n<li><a href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/bank-account-freezing-cybercrime-cases-bnss-section-106\/\">Bank Account Freezing in Cybercrime Cases: Law, BNSS Section 106, Rights &amp; Remedies<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/doctrine-of-proportionality-explained-meaning-four-tests-landmark-supreme-court-judgments-constitutional-importance\/\">Doctrine of Proportionality Explained: Meaning, Four Tests, Landmark Supreme Court Judgments &amp; Constitutional Importance<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/article-21-digital-rights-india-privacy-puttaswamy-dpdp-act-ai-governance\/\">Artificial Intelligence and the Right to Privacy under Article 21 of the Indian Constitution: Emerging Challenges and Legal Responses<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/digital-personal-data-protection-act-2023-right-to-privacy-in-india\/\">Digital Personal Data Protection Act 2023: Right to Privacy in India<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/fair-trial-vs-privacy-a-constitutional-tussle-in-limbo\/\">Fair Trial vs Privacy: A Constitutional Tussle In Limbo<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>State Accountability under the Digital Personal Data Protection Act 2023: Constitutional Privacy, Executive Power and the Limits of Digital Governance Abstract India&#8217;s rapid transition towards digital governance has fundamentally changed how the State collects, processes, stores, and uses personal information. Biometric identification, digital welfare delivery, interconnected databases, and technology-enabled public administration have improved administrative efficiency<\/p>\n","protected":false},"author":1920,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_forum_subforum_count":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"two_page_speed":[],"_jetpack_memberships_contains_paid_content":false,"_joinchat":[],"footnotes":""},"categories":[66],"tags":[5277],"class_list":["post-34008","post","type-post","status-publish","format-standard","category-cyber-law","tag-cyber-law"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.6 (Yoast SEO v28.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights - Legal Service India - Articles<\/title>\n<meta name=\"description\" content=\"Explore State accountability under India&#039;s DPDP Act 2023, privacy rights, government surveillance, and constitutional safeguards for personal data.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights\" \/>\n<meta property=\"og:description\" content=\"Explore State accountability under India&#039;s DPDP Act 2023, privacy rights, government surveillance, and constitutional safeguards for personal data.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/\" \/>\n<meta property=\"og:site_name\" content=\"Legal Service India - Articles\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/legalservicesind\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-12T08:23:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-12T08:25:52+00:00\" \/>\n<meta name=\"author\" content=\"thrain\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@legalserviceind\" \/>\n<meta name=\"twitter:site\" content=\"@legalserviceind\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"thrain\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"27 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/\"},\"author\":{\"name\":\"thrain\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#\\\/schema\\\/person\\\/3e90e560b4ad0dd78ca20663e2439611\"},\"headline\":\"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights\",\"datePublished\":\"2026-10-12T08:23:01+00:00\",\"dateModified\":\"2026-10-12T08:25:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/\"},\"wordCount\":5989,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#organization\"},\"keywords\":[\"Cyber Law\"],\"articleSection\":[\"Cyber Law\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/\",\"url\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/\",\"name\":\"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights - Legal Service India - Articles\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#website\"},\"datePublished\":\"2026-10-12T08:23:01+00:00\",\"dateModified\":\"2026-10-12T08:25:52+00:00\",\"description\":\"Explore State accountability under India's DPDP Act 2023, privacy rights, government surveillance, and constitutional safeguards for personal data.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/state-accountability-dpdp-act-2023\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber Law > DPDP Act 2023 and the Right to Privacy in India: State Accountability Explained\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#website\",\"url\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/\",\"name\":\"Legal Service India - Law Articles\",\"description\":\"Legal Service India - Law Article Directory is the oldest in India since 2000, with thousands of article written by lawyers, law Students and Scholars on all branches of law\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#organization\",\"name\":\"Legal Service India\",\"url\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/logo-circle-1.png\",\"contentUrl\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/logo-circle-1.png\",\"width\":105,\"height\":95,\"caption\":\"Legal Service India\"},\"image\":{\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/legalservicesind\",\"https:\\\/\\\/x.com\\\/legalserviceind\",\"https:\\\/\\\/www.youtube.com\\\/@LegalServiceIndia-lsi\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/#\\\/schema\\\/person\\\/3e90e560b4ad0dd78ca20663e2439611\",\"name\":\"thrain\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"\\\/\\\/www.gravatar.com\\\/avatar\\\/e71e8a77bcbf99dfe1053626bf2540b2?s=96&#038;r=g&#038;d=mm\",\"url\":\"\\\/\\\/www.gravatar.com\\\/avatar\\\/e71e8a77bcbf99dfe1053626bf2540b2?s=96&#038;r=g&#038;d=mm\",\"contentUrl\":\"\\\/\\\/www.gravatar.com\\\/avatar\\\/e71e8a77bcbf99dfe1053626bf2540b2?s=96&#038;r=g&#038;d=mm\",\"caption\":\"thrain\"},\"url\":\"https:\\\/\\\/www.legalserviceindia.com\\\/Legal-Articles\\\/author\\\/thrain\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights - Legal Service India - Articles","description":"Explore State accountability under India's DPDP Act 2023, privacy rights, government surveillance, and constitutional safeguards for personal data.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/","og_locale":"en_US","og_type":"article","og_title":"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights","og_description":"Explore State accountability under India's DPDP Act 2023, privacy rights, government surveillance, and constitutional safeguards for personal data.","og_url":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/","og_site_name":"Legal Service India - Articles","article_publisher":"https:\/\/www.facebook.com\/legalservicesind","article_published_time":"2026-10-12T08:23:01+00:00","article_modified_time":"2026-10-12T08:25:52+00:00","author":"thrain","twitter_card":"summary_large_image","twitter_creator":"@legalserviceind","twitter_site":"@legalserviceind","twitter_misc":{"Written by":"thrain","Est. reading time":"27 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#article","isPartOf":{"@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/"},"author":{"name":"thrain","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#\/schema\/person\/3e90e560b4ad0dd78ca20663e2439611"},"headline":"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights","datePublished":"2026-10-12T08:23:01+00:00","dateModified":"2026-10-12T08:25:52+00:00","mainEntityOfPage":{"@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/"},"wordCount":5989,"commentCount":0,"publisher":{"@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#organization"},"keywords":["Cyber Law"],"articleSection":["Cyber Law"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/","url":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/","name":"State Accountability under the Digital Personal Data Protection Act 2023: Privacy, Surveillance and Constitutional Rights - Legal Service India - Articles","isPartOf":{"@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#website"},"datePublished":"2026-10-12T08:23:01+00:00","dateModified":"2026-10-12T08:25:52+00:00","description":"Explore State accountability under India's DPDP Act 2023, privacy rights, government surveillance, and constitutional safeguards for personal data.","breadcrumb":{"@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/state-accountability-dpdp-act-2023\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/"},{"@type":"ListItem","position":2,"name":"Cyber Law > DPDP Act 2023 and the Right to Privacy in India: State Accountability Explained"}]},{"@type":"WebSite","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#website","url":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/","name":"Legal Service India - Law Articles","description":"Legal Service India - Law Article Directory is the oldest in India since 2000, with thousands of article written by lawyers, law Students and Scholars on all branches of law","publisher":{"@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#organization","name":"Legal Service India","url":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#\/schema\/logo\/image\/","url":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-content\/uploads\/2025\/06\/logo-circle-1.png","contentUrl":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-content\/uploads\/2025\/06\/logo-circle-1.png","width":105,"height":95,"caption":"Legal Service India"},"image":{"@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/legalservicesind","https:\/\/x.com\/legalserviceind","https:\/\/www.youtube.com\/@LegalServiceIndia-lsi"]},{"@type":"Person","@id":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/#\/schema\/person\/3e90e560b4ad0dd78ca20663e2439611","name":"thrain","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"\/\/www.gravatar.com\/avatar\/e71e8a77bcbf99dfe1053626bf2540b2?s=96&#038;r=g&#038;d=mm","url":"\/\/www.gravatar.com\/avatar\/e71e8a77bcbf99dfe1053626bf2540b2?s=96&#038;r=g&#038;d=mm","contentUrl":"\/\/www.gravatar.com\/avatar\/e71e8a77bcbf99dfe1053626bf2540b2?s=96&#038;r=g&#038;d=mm","caption":"thrain"},"url":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/author\/thrain\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/posts\/34008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/users\/1920"}],"replies":[{"embeddable":true,"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/comments?post=34008"}],"version-history":[{"count":2,"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/posts\/34008\/revisions"}],"predecessor-version":[{"id":34160,"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/posts\/34008\/revisions\/34160"}],"wp:attachment":[{"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/media?parent=34008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/categories?post=34008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.legalserviceindia.com\/Legal-Articles\/wp-json\/wp\/v2\/tags?post=34008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}