The word privacy does not appear anywhere in the Constitution of India. Yet today it is a fundamental right. This happened in 2017, when a nine-judge bench of the Supreme Court gave its verdict in the Justice K.S. Puttaswamy v. Union of India case. Exams ask about this judgment, the older cases it overruled, the Aadhaar verdict and the new data protection law. This post explains them in simple words. It ends with 15 previous year questions.
Key Points (Quick Revision)
- On 24 August 2017, a nine-judge bench held unanimously that privacy is a fundamental right.
- Privacy is protected mainly under Article 21 (life and personal liberty) and the freedoms in Part III.
- The verdict overruled the M.P. Sharma (1954) and Kharak Singh (1962) cases on this point.
- Privacy is not absolute; a limit must pass the tests of law, legitimate aim and proportionality.
- The Digital Personal Data Protection Act, 2023 is India's main law on personal data.
1. Background of the case
In 2012, Justice K.S. Puttaswamy, a retired judge of the Karnataka High Court, challenged the Aadhaar scheme in the Supreme Court. He argued that collecting fingerprints and iris scans of citizens violated their privacy.
The government replied that privacy was not a fundamental right, relying on two old judgments. Since those judgments were given by benches of eight and six judges, a larger bench of nine judges was formed to settle the basic question first: Is privacy a fundamental right?
2. The 2017 verdict
- All nine judges agreed that the right to privacy is a fundamental right.
- It is an intrinsic part of Article 21 and of the freedoms guaranteed in Part III.
- Privacy includes bodily privacy, informational privacy (data about a person) and decisional privacy (freedom to make personal choices).
- The Court linked privacy closely with human dignity and personal liberty.
- The Court asked the government to put in place a strong data protection framework.
3. Cases overruled and earlier cases
| Case | Year | What it said |
|---|---|---|
| M.P. Sharma v. Satish Chandra | 1954 | Eight judges said privacy is not a fundamental right (on search and seizure) - overruled on this point |
| Kharak Singh v. State of UP | 1962 | Struck down night-time home visits by police, but said privacy is not a fundamental right - overruled on this point |
| Govind v. State of MP | 1975 | Accepted a limited right to privacy, subject to restrictions |
| R. Rajagopal v. State of TN | 1994 | Linked privacy with the press; a person has a right to be left alone |
| PUCL v. Union of India | 1997 | Phone tapping affects privacy; laid down safeguards for tapping |
In the Kharak Singh case, a minority opinion had already said privacy is part of personal liberty. The 2017 bench accepted this view.
4. Limits on privacy - the three tests
Privacy is not absolute. The State can limit it, but only if the limit passes these tests:
| Test | Meaning |
|---|---|
| Legality | There must be a law that allows the limit |
| Legitimate aim | The law must serve a valid State purpose, such as national security or preventing crime |
| Proportionality | The limit must be no more than needed to achieve the aim |
Courts also expect procedural safeguards against misuse of power.
5. The Aadhaar judgment (2018)
- In September 2018, a five-judge bench decided the main Aadhaar case by a 4:1 majority.
- It upheld the Aadhaar Act for welfare schemes and for linking with PAN and income tax returns.
- It struck down Section 57, which had allowed private companies to demand Aadhaar.
- Aadhaar was held not mandatory for bank accounts, mobile connections and school admissions.
Privacy also shaped other 2018 verdicts, such as Navtej Singh Johar (consensual same-sex relations between adults decriminalised) and Joseph Shine (adultery law struck down).
6. Data protection law in India
- A committee headed by Justice B.N. Srikrishna gave a draft data protection framework in 2018.
- After several drafts, Parliament passed the Digital Personal Data Protection (DPDP) Act in August 2023.
- The person whose data is used is the Data Principal; the body that decides how to use it is the Data Fiduciary.
- Data is usually processed with the person's consent, and people get rights to access, correct and erase their data.
- Complaints go to the Data Protection Board of India; penalties can go up to ₹250 crore for a breach.
- The DPDP Rules, 2025 were notified in November 2025, with a phased rollout over about 18 months. Confirm the current status in the latest notice.
The Act also changed the RTI Act on sharing personal information, which has been debated.
7. Why the judgment matters
- It made privacy a basic right that every law must respect.
- It gives citizens a strong ground to challenge surveillance and misuse of data.
- It shaped later rulings on personal choice, dignity and equality.
- In the digital age, it is the base of India's data protection rules.
8. Previous year questions
- In which case did the Supreme Court hold privacy to be a fundamental right? – Justice K.S. Puttaswamy v. Union of India (2017)
- How many judges heard the 2017 privacy case? – Nine
- On which date was the privacy verdict given? – 24 August 2017
- Was the 2017 privacy verdict unanimous? – Yes
- Under which Article is the right to privacy mainly protected? – Article 21
- Which 1954 case had said privacy is not a fundamental right? – M.P. Sharma case
- Which 1962 case on police surveillance was overruled on privacy? – Kharak Singh case
- Which 1997 case laid down safeguards for phone tapping? – PUCL v. Union of India
- Which three tests must a limit on privacy pass? – Legality, legitimate aim and proportionality
- In which year was the main Aadhaar judgment given? – 2018
- Which section of the Aadhaar Act was struck down for allowing private use? – Section 57
- Which committee drafted a data protection framework in 2018? – Justice B.N. Srikrishna Committee
- In which year was the Digital Personal Data Protection Act passed? – 2023
- Which body hears complaints under the DPDP Act? – Data Protection Board of India
- Which 2018 case decriminalised consensual same-sex relations between adults? – Navtej Singh Johar case
9. How to revise this topic
Start with the verdict: Puttaswamy, 24 August 2017, nine judges, unanimous, privacy under Article 21 and Part III.
Next, learn the old cases: M.P. Sharma 1954 and Kharak Singh 1962 overruled; Govind 1975, Rajagopal 1994, PUCL 1997 supported privacy.
Then fix the three tests: legality, legitimate aim, proportionality.
Finally, remember Aadhaar 2018 (4:1, Section 57 struck down) and the DPDP Act 2023 (Data Principal, Data Fiduciary, Data Protection Board, up to ₹250 crore; Rules notified November 2025).
10. Frequently Asked Questions
Is the right to privacy a fundamental right in India?
Yes. In 2017, a nine-judge bench of the Supreme Court in the Puttaswamy case held that privacy is a fundamental right under Article 21 and Part III.
Which Article covers the right to privacy?
The right to privacy is mainly part of Article 21, which protects life and personal liberty, and also flows from other freedoms in Part III.
Is the right to privacy absolute?
No. The State can limit it through a law that serves a legitimate aim and is proportionate, with safeguards against misuse.
Which cases were overruled by the Puttaswamy judgment?
The M.P. Sharma case of 1954 and the Kharak Singh case of 1962 were overruled to the extent they said privacy is not a fundamental right.
What is the DPDP Act, 2023?
The Digital Personal Data Protection Act, 2023 is India's law on personal data. It sets rules for consent, gives rights to people and creates the Data Protection Board of India.
For more Polity topics in simple language, see our Fundamental Rights, Judicial Review and PIL and Right to Information Act posts, or browse the Polity section. Preparing for civil services? Start with the UPSC Civil Services guide or join the 100 Hour GS Course.