Overview
India’s right to privacy is now being tested by rapid advances in AI. While the Supreme Court affirmed privacy as a constitutional right in 2017, the existing legal framework struggles to keep pace.
Key Developments
- The Digital Personal Data Protection (DPDP) Act, 2023 was enacted to modernise data governance. Its detailed DPDP Rules were notified in November 2025 and will be implemented in phases, with consent and safety provisions becoming effective only in 2027.
- Before the DPDP regime, the primary law was the Information Technology (IT) Act, 2000 and its 2011 Rules, which regulated export of sensitive personal data but left out many everyday data points.
- Penalties under the IT Act were limited to three years’ imprisonment or a fine of ₹5 lakh for unauthorised disclosure of listed sensitive data, leaving a large gap for non‑sensitive yet personal information.
Important Facts
The IT Act’s 2011 Rules applied only to data categories like financial, medical, biometric, and sexual orientation. They did not cover names, addresses, phone numbers, caste, religion, political affiliation, browsing history, social media activity, behavioural patterns, or institutional affiliations. Consequently, a vast amount of personal data remains unprotected, even as AI systems increasingly process such information for profiling, recommendation engines, and decision‑making.
Exam Relevance
Understanding the interplay between data protection laws and emerging technologies is crucial for GS2 (Polity) and GS3 (Economy). Aspirants should note how constitutional rights shape legislation, the challenges of regulating fast‑moving tech, and the impact of legal gaps on privacy, innovation, and economic growth. The DPDP Act’s phased rollout also illustrates policy‑making dynamics and the balance between safeguarding rights and fostering a competitive AI ecosystem.
Way Forward
- Close the definition gap by extending the scope of "sensitive personal data" to include identifiers like phone numbers, addresses, and online behavioural data.
- Introduce stricter penalties for unauthorised processing of any personal data, not just the narrowly listed categories.
- Mandate transparent AI‑audit mechanisms under the DPDP Rules to ensure compliance with privacy norms.
- Encourage sector‑specific guidelines (e.g., fintech, health) that align AI innovation with constitutional privacy safeguards.
Addressing these gaps will help India protect its citizens’ privacy while staying competitive in the global AI race.