DPDP Act Supreme Court Review: Consent, exemptions, and the fight for an independent data regulator

The Digital Personal Data Protection Act, 2023, was India's first comprehensive data protection law. It was passed after six years of drafts, committee reports, and parliamentary debate. But from the moment it was enacted, it faced three fundamental criticisms: the government had exempted itself from the law, the Data Protection Board was not independent, and the consent framework was too weak.

The Supreme Court addressed all three. The judgment is essential for UPSC because it connects constitutional law (Article 21, right to privacy), governance (institutional independence of regulators), and technology policy (data protection in the digital economy).

---

Background: the long road to the DPDP Act

The journey began with the Puttaswamy judgment (2017) , where a nine-judge bench unanimously held that the right to privacy is a fundamental right under Article 21. The Court directed the government to enact a data protection law. The Srikrishna Committee (2018) submitted a draft bill. After multiple iterations, withdrawals, and a Joint Parliamentary Committee review, the DPDP Act was passed in 2023.

The Act's key provisions:

Provision	What It Does
Section 4	Defines grounds for processing personal data: consent or "legitimate uses"
Section 6	Requires "specific, informed, and unconditional" consent from the data principal
Section 9	Grants data principals rights: access, correction, erasure, grievance redressal
Section 17	Grants the central government power to exempt any government agency from the Act
Section 18	Establishes the Data Protection Board of India (DPBI)
Section 19	The DPBI's composition, appointment, and removal are under central government control

The Act was criticised from the moment it was passed. Civil society argued Section 17 created a surveillance state loophole. Legal scholars argued Section 19 violated institutional independence. Technology companies argued the compliance burden would stifle innovation.

---

The three provisions the Court reviewed

The lead petition was filed by the Internet Freedom Foundation, joined by digital rights organisations, journalists, and individual citizens. They challenged three provisions:

Section 17 — Government exemptions: Allowing the government to exempt any agency from the entire Act, without judicial oversight or even ex-post review, violates Article 14 (arbitrary power) and Article 21 (right to privacy).

Section 19 — Data Protection Board composition: All members are appointed by and removable by the central government. The Chairperson is a serving or retired bureaucrat. This violates the principle of institutional independence affirmed in the NJAC judgment (2015) and Madras Bar Association (2014).

Section 6 — Consent framework: The Act's definition of consent as "specific, informed, and unconditional" is undermined by the "legitimate uses" provision in Section 4, which allows data processing without consent for purposes defined by the government.

---

What the Court held

A five-judge Constitution bench delivered the judgment. Justice K.V. Viswanathan wrote the majority opinion (4:1). Justice B.V. Nagarathna wrote a partially concurring, partially dissenting opinion.

On Section 17: Government exemptions

The Court struck down the word "any" in Section 17(1) as unconstitutional. The government can exempt specific agencies for specific purposes. It cannot issue a blanket exemption covering all government data processing. The exemption must be proportionate to the stated purpose and subject to periodic review by a parliamentary committee.

Justice Nagarathna, in her dissent, went further. She would have required the government to obtain prior judicial authorisation for any exemption, similar to the warrant requirement for surveillance under the Puttaswamy framework.

On Section 19: Data Protection Board independence

The Court held that the current composition — where all members are appointed and removable by the executive — fails the test of institutional independence. It directed the government to amend Section 19 within twelve months to ensure:

• The majority of Board members, including the Chairperson, are appointed by a committee comprising the Chief Justice of India (or a Supreme Court judge nominated by the CJI), the Leader of Opposition, and the Cabinet Secretary
• Members can only be removed through the same process as the Chief Election Commissioner: by the President on the recommendation of the Supreme Court after an inquiry
• The Board must have technical members (data scientists, cybersecurity experts) in addition to legal and administrative members

On Section 6: Consent framework

The majority upheld the consent framework but read into it that consent must be specific, informed, granular, and revocable. This means:

• A data collector cannot bundle consent across multiple purposes
• Consent once given can be withdrawn, and the process for withdrawal must be as easy as the process for giving it
• "Legitimate uses" under Section 4 cannot be used to bypass consent for core personal data

---

The dissent: Justice Nagarathna's privacy position

Justice Nagarathna's dissent stakes out a stronger position on digital privacy. She would have held that:

• Government data processing for non-national-security purposes must meet the same consent standards as private data processing
• The Data Protection Board must be entirely independent of the executive, not just majority-independent
• The Act should create a statutory tort of privacy violation, allowing citizens to sue the government for damages when their data is misused

Her dissent follows the intellectual tradition of her father, former Chief Justice E.S. Venkataramiah, known for strong civil liberties positions.

---

Prelims traps

Statement	True or False	Why
"The DPDP Act provides identical consent requirements for government and private entities"	False	Section 17 allows the government broader exemptions
"The Supreme Court struck down the DPDP Act as unconstitutional"	False	The Court upheld the Act but read down specific provisions and directed amendments
"The Data Protection Board members are appointed by an independent committee"	Partially true only after the government amends the Act	Currently, all members are appointed by the central government
"Consent under the DPDP Act, once given, cannot be withdrawn"	False	The Court specifically held that consent must be revocable

---

Part of: Supreme Court Judgments: April to June 2026

Read next: M.K. Ranjitsinh: The right against climate change · Punjab fiscal federalism case