Digital Personal Data Protection Act 2023

Story hook

In August 2017, a nine-judge bench of the Supreme Court was hearing a quiet challenge to the Aadhaar project. The petitioner, retired Justice K.S. Puttaswamy, was 92 years old. His question was disarmingly simple: does the Constitution recognise a right to privacy?

In a 547-page judgment, the Court answered yes — privacy is a fundamental right under Articles 14, 19 and 21. Justice D.Y. Chandrachud, writing for four of the nine judges, said informational privacy was an "essential facet" of human dignity. The judgment also did something extraordinary: it directed the Union government to enact a comprehensive data protection law.

Six years, three draft bills, and one mass public consultation later, the Digital Personal Data Protection Act, 2023 was notified on 11 August 2023. The law is short — just 44 sections. It borrows ideas from the EU's GDPR but pares them down for Indian realities. It also creates a Data Protection Board with the power to fine offending entities up to ₹250 crore per breach. This is the story of how India finally got a privacy law — and why critics say it gives the State too much room to look the other way.

Why this matters for UPSC

Data protection is the highest-frequency tech-policy topic in recent UPSC papers — at least one Prelims question in 2023 and 2024, multiple Mains questions on privacy, surveillance, and digital rights, and standard Interview fodder for any candidate with a tech background. The topic intersects Polity (fundamental rights, Article 21), Internal Security (data localisation, surveillance), and Economy (compliance costs, digital trade).