DPDP Act Fundamentals: Free Beginner Course

Why India Needed a Data Protection Law

Before 2017, India had no explicit constitutional right to privacy. While Article 21 of the Constitution guarantees the "right to life and personal liberty," courts had given conflicting opinions on whether privacy was included.

The Puttaswamy Judgment (2017)

In Justice K.S. Puttaswamy (Retd.) v. Union of India, a nine-judge Constitution Bench of the Supreme Court unanimously held that the right to privacy is a fundamental right protected under Article 21.

This was monumental for three reasons:

1. Constitutional mandate: It created a binding obligation on the State to protect personal data through legislation.
2. Overruled prior positions: It overruled the majority opinions in M.P. Sharma v. Satish Chandra (1954) and Kharak Singh v. State of UP (1962) that had denied privacy as a fundamental right.
3. Three-part test: Justice Chandrachud's opinion established that any invasion of privacy must satisfy:
   • Legality — prescribed by law
   • Legitimate aim — a valid state objective
   • Proportionality — the measure must be proportionate to the need

Why This Matters for You

Every organisation processing personal data in India now operates under a constitutional framework that treats privacy as non-negotiable. The DPDP Act is the legislative response to this mandate.

Key takeaway: The Puttaswamy judgment is the constitutional anchor for India's entire data protection regime. Understanding it helps you appreciate why compliance is not optional but constitutionally required.

The Pre-DPDPA Landscape

Before the DPDP Act, India's data protection relied on:

• Information Technology Act, 2000 — Section 43A and the IT (Reasonable Security Practices) Rules, 2011 governed "sensitive personal data or information" (SPDI) for body corporates.
• These rules were narrow: they applied only to body corporates handling SPDI, not to all entities processing all personal data.
• No independent regulator: enforcement was through civil courts and the IT Act's adjudication officers — slow and inconsistent.

The gap was clear: India needed comprehensive, modern data protection legislation.