Is Privacy a Fundamental Right in India?
On 24 August 2017, nine judges of India's Supreme Court unanimously ruled that privacy is a fundamental right. Here is what the case decided, why it overturned decades of precedent, and how it shapes data and technology law today.
Yes. On 24 August 2017, a nine-judge bench of the Supreme Court of India ruled unanimously in Justice K.S. Puttaswamy (Retd.) v. Union of India that privacy is a fundamental right protected under Article 21 and Part III of the Constitution. The judgement overruled earlier decisions that had suggested otherwise and set the framework for later cases on Aadhaar and data protection.
On 24 August 2017, a nine-judge bench of the Supreme Court of India delivered one of the most consequential constitutional rulings of the century. In Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors., the Court held unanimously that the right to privacy is a fundamental right protected by the Constitution of India. In a country of more than a billion people moving rapidly online, the ruling reset the relationship between the citizen, the state and technology.
How the case reached nine judges
The case grew out of challenges to Aadhaar, India's biometric identity programme, which collects fingerprints and iris scans and assigns each resident a unique 12-digit number. Retired Karnataka High Court judge K.S. Puttaswamy filed a petition in 2012 arguing that the scheme violated citizens' privacy.
The government responded with a striking argument: that Indians had no fundamental right to privacy at all. It relied on two older decisions of the Supreme Court:
- M.P. Sharma v. Satish Chandra (1954), an eight-judge bench ruling on search and seizure, which had rejected importing a privacy right into the Constitution.
- Kharak Singh v. State of Uttar Pradesh (1962), a six-judge bench ruling on police surveillance, whose majority held that privacy was not a guaranteed right.
Because those benches were large, a smaller bench could not overrule them. On 18 July 2017 a Constitution Bench referred the question to a bench of nine judges, the size needed to settle it for good.
What the Court decided
The nine judges delivered six separate opinions, with the lead opinion written by Justice D.Y. Chandrachud on behalf of four judges. Despite the different reasoning, they agreed on the central points:
- Privacy is a fundamental right. It is protected as an intrinsic part of the right to life and personal liberty under Article 21, and as part of the freedoms guaranteed in Part III of the Constitution.
- The old precedents were overruled to the extent they held otherwise. M.P. Sharma and the relevant part of Kharak Singh no longer stand.
- Privacy is not absolute. The state may restrict it, but only if the restriction meets a three-part test, discussed below.
- Privacy has many dimensions: bodily integrity, personal decisions about family, marriage and sexuality, and informational privacy, a person's control over data about themselves.
The lead opinion also described privacy as a natural right inherent in every individual, rooted in human dignity and autonomy rather than granted by the state.
The test for limiting privacy
Any state action that intrudes on privacy must satisfy three requirements set out in the lead opinion:
| Requirement | What it means |
|---|---|
| Legality | There must be a law authorising the intrusion |
| Legitimate aim | The law must pursue a legitimate state purpose |
| Proportionality | The intrusion must be proportionate to the purpose, with a rational connection between means and ends |
Proportionality has since become a central tool in Indian constitutional law, used to scrutinise everything from surveillance to welfare schemes.
The ripple effects
Puttaswamy quickly reshaped Indian law in ways that reached far beyond Aadhaar:
- Aadhaar itself (2018): a five-judge bench in a follow-up case upheld the Aadhaar scheme for welfare and subsidies, but struck down Section 57 of the Aadhaar Act, which had allowed private companies to demand Aadhaar authentication. Mandatory linking of Aadhaar to bank accounts and mobile numbers was also struck down.
- Decriminalising homosexuality (2018): in Navtej Singh Johar v. Union of India, the Supreme Court read down Section 377 of the Indian Penal Code to decriminalise consensual same-sex relations between adults, drawing heavily on Puttaswamy's recognition of sexual orientation as part of privacy and dignity.
- Data protection law (2023): the judgement urged the government to create a robust data protection regime. After several drafts, Parliament passed the Digital Personal Data Protection Act, 2023, India's first comprehensive data protection statute.
A global conversation
Puttaswamy placed India within a worldwide movement to protect privacy in the digital age. The judges surveyed courts and constitutions across the world, from the United States and the United Kingdom to South Africa and the European Court of Human Rights.
Its closest legislative counterpart is the European Union's General Data Protection Regulation (GDPR), adopted in April 2016 and applicable from 25 May 2018. The GDPR grants rights such as access to and erasure of personal data, and allows fines of up to €20 million or 4% of a company's worldwide annual turnover, whichever is higher. Where the GDPR built privacy protections through legislation, Puttaswamy anchored them in constitutional rights, meaning that any future law, including India's own data law, must answer to the standard the Court set.
Why it matters
The deeper significance of Puttaswamy is its view of the individual. The judges rejected the idea that privacy is an elite concern irrelevant to people struggling with poverty, insisting that dignity and liberty belong to everyone. In an era of biometric databases, smartphones and artificial intelligence, the case gives every Indian a constitutional basis to ask a simple question of any government or company handling their data: is this lawful, necessary and proportionate?
Sources
- Supreme Court of India, Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors., Writ Petition (Civil) No. 494 of 2012, judgement of 24 August 2017: full text (sci.gov.in), also on Indian Kanoon
- Supreme Court Observer, Aadhaar case materials: scobserver.in
- Navtej Singh Johar v. Union of India (2018): full text (sci.gov.in)
- Digital Personal Data Protection Act, 2023: Ministry of Electronics and IT
- Regulation (EU) 2016/679 (GDPR): EUR-Lex
The ruling's reach grows as daily life moves online, from QR-code payments over UPI to the undersea cables that carry Indian data abroad. For another landmark from a young constitutional court, see how South Africa abolished the death penalty.