RIGHT TO PRIVACY AND DATA PROTECTION IN THE DIGITAL AGE: A CRITICAL LEGAL ANALYSIS OF INDIA'S DIGITAL PERSONAL DATA PROTECTION ACT, 2023

Abstract

The right to privacy in India acquired constitutional status through the Supreme Court's landmark ruling in Justice K.S. Puttaswamy v. Union of India, which held informational privacy to be an intrinsic facet of the right to life and personal liberty. Six years later, Parliament enacted the Digital Personal Data Protection Act to give statutory shape to this right in the context of digital data processing. This paper undertakes a doctrinal legal analysis of the Act, examining its constitutional foundation, its core architecture of consent, data principal rights and data fiduciary obligations, and the institutional design of the Data Protection Board. The study adopts a qualitative, library-based method, drawing upon primary legal sources, government notifications and secondary academic and professional commentary, and situates the Indian framework within a brief comparative reading of the European Union's General Data Protection Regulation. The analysis finds that while the Act represents a significant legislative advance, it exhibits notable gaps, including broad governmental exemptions, the absence of a differentiated category of sensitive personal data, limited independence of the regulatory Board, and a phased and delayed implementation timeline. The paper concludes that the effectiveness of India's data protection regime will depend substantially on the manner in which subordinate rules are framed and enforced, and it offers recommendations for strengthening institutional independence and rights enforcement.