Why the case arose: Aadhaar and the privacy question
The litigation began as a challenge to the Aadhaar programme. Petitioners argued that mandatory biometric enrolment violated their right to privacy. The Union of India contended that no fundamental right to privacy existed—relying on two earlier decisions, M.P. Sharma v. Satish Chandra (1954, eight-judge bench) and Kharak Singh v. State of Uttar Pradesh (1962, six-judge bench), which had declined to recognise a standalone privacy right.
A three-judge bench hearing the Aadhaar challenge referred the threshold question—“Is privacy a fundamental right?”—to a larger bench. The Chief Justice of India constituted a nine-judge bench, the largest in decades, to settle the matter.
The holding: privacy as a fundamental right
All nine judges agreed that the right to privacy is constitutionally protected. The majority opinion (by Justice D.Y. Chandrachud, concurred in by the Chief Justice and Justices Agrawal, Nazeer and Sapre) located privacy in the concept of personal liberty under Article 21, with intersections in the freedoms guaranteed by Article 19(1)(a) (speech) and the equality protection of Article 14.
The judgment overruled M.P. Sharma and Kharak Singh to the extent they held that no right to privacy existed. Justice Chelameswar, Justice Bobde, Justice Nariman and Justice Kaul each wrote concurring opinions that expanded on different dimensions—informational privacy, bodily autonomy, the privacy of choice—but all converged on the conclusion that privacy is a fundamental right.
- Article 21: privacy inheres in the right to life and personal liberty
- Article 19(1)(a): privacy protects informational self-determination and freedom of thought
- Article 14: state surveillance applied unequally violates the right to equality
- Overruled: M.P. Sharma (1954) and Kharak Singh (1962) to the extent they denied a privacy right
The three-part test for restricting privacy
A fundamental right is not absolute. The judgment established that any state restriction on the right to privacy must satisfy three requirements:
- 01
Legality
The restriction must be prescribed by law—an existing statute, not an executive order or administrative practice. The DPDPA serves precisely this function: it is the “law” that authorises and constrains data processing by Data Fiduciaries.
- 02
Legitimate aim
The law must serve a legitimate state interest—national security, prevention of crime, public health or another recognised purpose. Section 7 of the DPDPA lists the “legitimate uses” that justify processing without consent.
- 03
Proportionality
The means adopted must be proportionate to the need. The DPDPA’s purpose-limitation principle (Section 4), data-minimisation requirement and time-bound retention (Section 8(7)) are proportionality mechanisms.
Informational privacy and data protection
Justice Sanjay Kishan Kaul’s concurrence identified informational privacy as a distinct facet of the right to privacy. Informational privacy concerns the individual’s ability to control what data about them is collected, who holds it and how it is used.
This dimension is the direct constitutional anchor for the DPDPA. Section 6 (consent), Section 5 (notice), Sections 11–14 (Data Principal rights) and Section 8(7) (erasure upon purpose completion) are legislative implementations of informational privacy as articulated in Puttaswamy.
The judgment also noted that a data-protection framework was an “essential facet” of personal liberty—effectively mandating Parliament to enact comprehensive data-protection legislation.
From Puttaswamy to the DPDPA: the legislative journey
The judgment triggered a sequence of legislative efforts. Justice B.N. Srikrishna was appointed to chair a committee on data protection. The committee’s report (“A Free and Fair Digital Economy”, July 2018) accompanied a draft Personal Data Protection Bill, 2018. That Bill was revised and introduced in Parliament as the Personal Data Protection Bill, 2019, referred to a Joint Parliamentary Committee, and finally withdrawn in 2022.
The Digital Personal Data Protection Act, 2023, was introduced as a fresh Bill, passed by Parliament on 9 August 2023, and received Presidential assent on 11 August 2023. The DPDP Rules were notified in November 2025. Core obligations take effect from May 2027.
| Date | Event | Significance |
|---|---|---|
| 24 Aug 2017 | Puttaswamy judgment | Right to privacy declared fundamental; data-protection law mandated |
| Jul 2018 | Srikrishna Committee report | First comprehensive data-protection Bill drafted |
| Dec 2019 | PDP Bill introduced in Lok Sabha | Referred to Joint Parliamentary Committee |
| Aug 2022 | PDP Bill withdrawn | Government opted for a fresh approach |
| 11 Aug 2023 | DPDPA receives Presidential assent | India’s first comprehensive data-protection statute enacted |
| Nov 2025 | DPDP Rules 2025 notified | Procedural framework for compliance set |
| May 2027 | Core obligations take effect | Full enforcement begins |
Why Puttaswamy still matters for compliance
The judgment is not merely historical. Any challenge to DPDPA provisions—or to government processing under Section 17 exemptions—will be tested against the Puttaswamy three-part framework. If a Section 17 notification fails the proportionality test, it can be struck down.
For Data Fiduciaries, Puttaswamy provides the interpretive lens through which courts will read the DPDPA. Purpose limitation, data minimisation and time-bound retention are not just statutory obligations—they are constitutional expectations. A compliance programme that meets the statutory letter but ignores the proportionality spirit risks judicial scrutiny.
How AMLEGALS advises on constitutional data privacy
AMLEGALS is an Indian law firm. Its data privacy practice is led by Anandaday Misshra, Founder and Managing Partner, with Rohit Lalwani, Associate Partner, working on DPDPA compliance. The firm assists organisations in understanding how the Puttaswamy framework shapes their DPDPA obligations, advises on proportionality-aligned compliance programmes, and represents parties in Data Protection Board proceedings where constitutional questions arise.