Right to Privacy
The fundamental right of individuals to privacy, recognised by the Supreme Court as part of Article 21 of the Constitution.
The right to privacy is a person's right to control their private life and personal information. In India, the Supreme Court has held that it is a fundamental right under the Constitution.
Meaning of Right to Privacy
In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge bench held that privacy is a fundamental right. That decision paved the way for the DPDP Act.
The Constitution of India does not mention privacy in so many words. The right was recognised by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India, decided on 24 August 2017 by a nine-judge bench. The Court held that privacy is intrinsic to life and personal liberty under Article 21 and is part of the freedoms guaranteed by Part III. Earlier decisions in M.P. Sharma (1954) and Kharak Singh (1962) had suggested otherwise, and the Court overruled them to that extent.
The judgment describes privacy as having several aspects: bodily integrity, choices about family and personal life, and informational privacy, the control that people have over data about themselves. That last aspect is what data protection law aims to protect. The Court also made clear that privacy is not absolute. A restriction must satisfy a test: it must be backed by a law, serve a legitimate aim of the State, and be proportionate to the aim, meaning no more intrusive than necessary.
Constitutional rights usually operate against the State. A person whose privacy is violated by a government agency can seek remedies under Articles 32 and 226. Private organisations, by contrast, are bound through statutes. The DPDP Act is a main example: it turns the constitutional idea into practical duties for Data Fiduciaries, including notice, consent, security safeguards, breach reporting, erasure and grievance redressal, backed by penalties decided by the Data Protection Board.
The Act also reflects the balance the Court described. It gives the State exemptions under Section 17 for matters such as sovereignty, security and public order, and for processing by specified State instrumentalities, and it permits processing for certain legitimate uses without consent under Section 7. Whether those exemptions strike the right balance has been debated publicly, and a person who believes a State action goes too far may test it against the proportionality standard in court. Privacy as a right is therefore broader than the DPDP Act, which covers the digital personal data part of it.
Examples of Right to Privacy
A court cites the right to privacy when testing whether a government data collection is lawful.
A company wants to install software that records employees' screens all day. HR asks whether it is needed, finds a lighter option that monitors only work systems during working hours, and explains this in a notice.
A State portal asks citizens for far more data than a service needs. A citizen's group points to the proportionality principle from Puttaswamy and asks the department to limit collection to what is necessary.
A fitness app wants to share users' location trails with advertisers. Its privacy team decides that the information is too revealing for that purpose, drops the idea, and keeps location data on the device.
Why Right to Privacy matters
For organisations, the right to privacy explains why regulators and courts take data misuse seriously. Compliance with the DPDP Act is not only a matter of avoiding a penalty of up to ₹250 crore; it is part of respecting a right that the Constitution recognises. Companies that treat privacy as a design principle tend to face fewer disputes and complaints.
For individuals, the right is the foundation of every request they can make: to know what is held about them, to correct it, to take back consent, and to complain. It also supports challenges to State surveillance or data collection that is not backed by law or is disproportionate.
How it works in practice
- 1Embed privacy in product design. Before launching a feature, ask what data it needs, what the person has been told, and whether a less intrusive design would meet the same aim.
- 2Use the Puttaswamy tests as an internal checklist for any intrusive measure such as monitoring employees or verifying customers: is there a legal basis, a legitimate aim, and proportionality?
- 3Write privacy commitments into your notice and honour them. Rule 3 requires clear, plain language about what you do with data and how to withdraw consent.
- 4Provide accessible routes for people to raise concerns: a published contact point under Section 8(9), a grievance process under Section 8(10), and information about the Board complaint route.
- 5Train staff, from developers to customer support, on why privacy matters, using concrete cases from your own business.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Thinking privacy means secrecy. It is about control and fair use of information, and it allows lawful processing.
Assuming the right is absolute. Restrictions are allowed if they meet the legality, legitimate aim and proportionality tests.
Treating the DPDP Act as the whole right. The Act covers digital personal data. The constitutional right is wider.
Believing the Constitution binds private firms directly. Duties on private organisations mainly arise through statutes like the DPDP Act.
Compliance tips
Run a short privacy impact review for new products, even where the law does not require one.
Keep the Puttaswamy proportionality questions on your design review template.
Make privacy settings easy to find and use.
Document why each category of data is collected so you can justify it to the Board or to a court.
Common questions about Right to Privacy
Is the right to privacy a fundamental right in India?
Yes. In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge bench of the Supreme Court held that privacy is a fundamental right under Article 21 and the freedoms in Part III of the Constitution.
Is the right to privacy absolute?
No. The Court held that restrictions are permitted if they are backed by law, serve a legitimate aim and are proportionate. The same balance appears in the DPDP Act's exemptions and legitimate uses.
Can I enforce the right to privacy against a private company?
Generally the fundamental right is enforced against the State. Against a private company, your remedies come from statutes such as the DPDP Act, which gives rights to information, correction, erasure and grievance redressal, and lets you complain to the Board.
How is the DPDP Act connected to the right to privacy?
The Act is India's statutory framework for protecting digital personal data, developed after the Puttaswamy judgment recognised privacy as a fundamental right and called for a data protection regime.