The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) marks a decisive moment in India’s constitutional and regulatory engagement with privacy in the digital age. For the first time, India has enacted a unified, economy-wide statute governing the collection, processing, and use of digital personal data. The Act is not merely a compliance framework; it represents the culmination of decades of judicial evolution, policy deliberation, and legislative contestation over privacy, individual autonomy, and State power.
India’s data protection journey began not with legislation but with constitutional adjudication. Early Supreme Court decisions such as M.P. Sharma v. Satish Chandra (1954) and Kharak Singh v. State of Uttar Pradesh (1963) rejected privacy as an independent fundamental right, treating it as incidental to personal liberty. This restrictive approach gradually softened in Gobind v. State of Madhya Pradesh (1975), where privacy was acknowledged as implicit in ordered liberty, though still without definitive constitutional...
