The Evolving Jurisprudence of Data Protection and Privacy in India: A Critical Analysis of the Digital Personal Data Protection Act, 2023
Abstract
The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) marks a watershed moment in India's data protection jurisprudence, codifying the fundamental right to informational privacy recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). This paper provides a critical, chapter-wise analysis of the DPDP Act, examining its structural framework, the rights of data principals, the obligations of data fiduciaries, and the institutional architecture of the Data Protection Board of India. While the Act introduces a principles-based regime aligned with global standards—including consent as the cornerstone of lawful processing, purpose limitation, data minimisation, and stringent penalties up to ₹250 crore—it faces substantial criticism for legislative minimalism, expansive state exemptions under Section 17 on national security and public order grounds, and the absence of robust safeguards against automated decision-making and profiling. Through doctrinal analysis and comparative evaluation against the EU GDPR, this study identifies key deficiencies including excessive executive discretion, dilution of consent through "legitimate uses," and the omission of data portability rights. The paper concludes with recommendations for legislative amendments to strengthen judicial oversight, narrow state exemptions, and enhance data principal rights, ensuring the DPDP Act fulfils its constitutional promise of balancing technological advancement with the fundamental right to privacy. Keywords: Data Protection, Privacy, DPDP Act 2023, Puttaswamy Case, Informational Privacy, Data Fiduciary, Data Principal, State Exemptions, India