Puttaswamy Judgment
The 2017 Supreme Court decision, Justice K.S. Puttaswamy (Retd.) v. Union of India, that recognised privacy as a fundamental right.
The Puttaswamy judgment is the Supreme Court's 2017 decision that privacy is a fundamental right in India. It is the starting point for the DPDP Act.
Meaning of Puttaswamy Judgment
The nine-judge bench held that privacy is protected under Article 21 and as part of the freedoms in Part III of the Constitution. It asked the Government to create a data protection framework, which led to the DPDP Act.
The case is Justice K.S. Puttaswamy (Retd.) v. Union of India. Justice Puttaswamy, a retired judge of the Karnataka High Court, challenged the Aadhaar scheme, and the question whether Indians have a fundamental right to privacy was referred to a nine-judge bench. On 24 August 2017 the bench held, unanimously on the central question, that the right to privacy is protected as an intrinsic part of life and personal liberty under Article 21 and as part of the freedoms in Part III of the Constitution. The Court overruled the parts of M.P. Sharma (1954) and Kharak Singh (1962) that had denied such a right.
The judgment is long, with several opinions, but its core points are widely cited. Privacy covers bodily integrity, personal choices and informational control. Any interference by the State must meet a threefold test: there must be a law, the aim must be legitimate, and the interference must be proportionate to that aim. The Court also recognised the importance of informational privacy in the digital era, noting the risks from data collection by both State and private actors, and observed that the Government should put in place a robust data protection regime after due consideration.
That observation led to the data protection journey. The Government constituted an expert committee under Justice B.N. Srikrishna later in 2017, which produced a report and draft Bill in 2018. After several drafts, withdrawals and consultations, Parliament passed the Digital Personal Data Protection Act in 2023, and the DPDP Rules were notified in 2025. The Act's emphasis on notice, valid consent, purpose limitation, security safeguards and grievance redressal, and its exemptions for specified State functions under Section 17, can be read as an attempt to balance the rights and interests the judgment identified.
The Aadhaar challenge itself was decided separately. In 2018, a five-judge bench in a later decision in the same litigation upheld the Aadhaar Act with conditions and read down or struck down provisions, including one that allowed private entities to demand Aadhaar-based authentication. The Aadhaar Act, 2016 continues to apply alongside the DPDP Act under Section 38. Consult the judgments themselves for precise holdings, because the opinions differ in reasoning.
Examples of Puttaswamy Judgment
Commentary on the DPDP Act usually begins with the Puttaswamy judgment.
A law firm prepares a client briefing on the DPDP Act. It starts with the Puttaswamy decision, explains the proportionality test, and shows how the Act's exemptions relate to that test.
A municipal team plans facial recognition cameras. The legal adviser asks for the law that authorises the system, the specific aim, and why less intrusive alternatives would not work, applying the questions drawn from the judgment.
A university's compliance office uses the judgment in staff training to explain why student records must be handled with care, and how the DPDP Act's rights flow from the constitutional principle.
Why Puttaswamy Judgment matters
The judgment changed the legal conversation. Before it, a person challenging a government data practice faced the argument that privacy was not constitutionally protected. After it, State action that collects or uses personal data must be justified by law and proportionality. For organisations, data-protection compliance is part of respecting a constitutional value, and courts and the Board are likely to read the DPDP Act with that background in mind.
For lawyers, policy teams and compliance leaders, knowing the decision is useful when explaining the Act to boards and clients. It supports the argument that privacy investments are not optional extras, and it provides the vocabulary of legality, necessity and proportionality that helps in assessing intrusive practices.
How it works in practice
- 1Read the judgment summary and key passages, not only commentary. Several law-reporting sites and the Supreme Court website publish the full text and headnotes. Note the paragraphs on informational privacy and the proportionality test.
- 2Use the threefold test in your assessments: identify the legal basis, state the legitimate aim in a sentence, and test whether a less intrusive method would work.
- 3Train your board and management on the link between the judgment and the DPDP Act. A one-page briefing is usually enough to explain why the Act exists and what values underlie it.
- 4Reflect the principles in your policies on data minimisation, purpose limitation and security, and cite them when you explain a decision to decline an intrusive request internally.
- 5For public-sector or State-linked projects, build a proportionality note into project approvals, recording why the data collected is needed and how it will be protected.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Confusing the 2017 and 2018 decisions. The 2017 nine-judge decision recognised privacy as a fundamental right. The 2018 five-judge decision dealt with the validity of Aadhaar.
Saying the judgment created the DPDP Act. It prompted the move towards a data protection law, but the Act is the product of later committees, drafts and legislation.
Overstating its reach to private parties. The fundamental right is generally enforced against the State. Duties on companies come through statutes.
Quoting from memory. Cite the judgment from the official text to avoid misattribution.
Compliance tips
Keep a short, accurate summary of the judgment in your compliance wiki, with a link to the official text.
Remind teams that privacy is not absolute and that proportionality is the benchmark for intrusive measures.
When explaining to customers, link the judgment to their rights under the DPDP Act in plain words.
Update your internal training when significant new rulings on privacy and data protection are delivered.
Common questions about Puttaswamy Judgment
What did the Puttaswamy judgment decide?
It held, through a nine-judge bench on 24 August 2017, that privacy is a fundamental right under Article 21 and Part III of the Constitution, overruling earlier decisions to the contrary, and set out a legality, legitimate aim and proportionality test for restrictions.
How is the Puttaswamy judgment linked to the DPDP Act?
The Court recognised informational privacy and noted the need for a data protection regime. That prompted expert committees and bills that led, in 2023, to the Digital Personal Data Protection Act.
Does the judgment apply to private companies?
The fundamental right is generally enforced against the State. Private companies owe duties through laws like the DPDP Act. Whether and how the right applies in a private dispute is a legal question that needs professional advice.
Is the Aadhaar case the same as the privacy case?
They arise from the same litigation but are different decisions. The 2017 nine-judge decision recognised the right to privacy, and a 2018 five-judge decision later upheld Aadhaar subject to limits. Both should be read for their own holdings.