Privacy in India has had an unusually long and uneven path to becoming a right anyone could actually rely on, and the story of how it got there says almost as much about Indian governance as the law itself does.
The Puttaswamy watershed
For decades, Indian courts circled the question of whether privacy was protected by the Constitution at all, without a definitive answer for the country as a whole. Earlier judgments found pieces of a privacy interest tucked inside other rights, but no single ruling settled the matter outright. That uncertainty ended in August 2017, when a nine-judge bench of the Supreme Court in Justice K.S. Puttaswamy versus Union of India unanimously held that privacy is a fundamental right protected under Article 21 of the Constitution. The judgment explicitly noted that a right of this significance needed legislative backing, effectively setting the agenda for the decade that followed.
The false starts
The path from Puttaswamy to an actual statute was not quick. A committee led by Justice B.N. Srikrishna proposed a draft data protection bill in 2018, a revised version was introduced in Parliament in 2019, and it was withdrawn in 2022 after extended committee review and public feedback. The debate over data localisation, state exemptions and corporate compliance costs slowed the process, leaving citizens with a constitutional guarantee but no statutory mechanism to enforce it against private companies.
The 2023 Act and 2025 Rules
A fresh draft followed, and the Digital Personal Data Protection Act, 2023 finally received Parliamentary passage and Presidential assent in August 2023, six years after the Court had said this needed to happen. Even with the Act passed, India's privacy framework remained largely theoretical until the Digital Personal Data Protection Rules, 2025 were notified, establishing the Data Protection Board and setting out the operational details on a phased timeline running into 2027. So was privacy there? In one sense, the Supreme Court said it always had been. Whether it is meaningfully there now depends on how consistently the Board and the businesses they govern actually behave over the years ahead.