India’s upcoming Digital Personal Data Protection Act, set to go into full effect in May 2027, is intended as a national privacy framework inspired by Europe’s GDPR. However, its broad exemptions for government data use and law enforcement processing significantly limit individual privacy protections, drawing challenges in India’s Supreme Court.
- Law enforcement exempted from most data protections without case-by-case oversight
- Government can exclude entire agencies from the law’s obligations via notification
- Right to erasure and transparency significantly restricted for state-held data
What happened
India’s Digital Personal Data Protection Act (DPDPA) was enacted in 2023 and is scheduled to become fully operational on May 13, 2027. While initially presented as India’s data privacy framework analogous to Europe’s General Data Protection Regulation (GDPR), the law distinguishes itself with extensive exemptions favoring the government. The law defines data fiduciaries and principals and establishes rights such as notice, consent, and erasure but excludes broad categories of government data processing from these obligations, particularly in criminal justice and official administration.
Specifically, Section 17 exempts law enforcement and government agencies from requirements related to individual rights, data export limits, and security in certain cases. Moreover, the central government can exempt entire agencies or categories of data fiduciaries from the law through simple notifications without imposing conditions or providing avenues for challenge. The law further restricts transparency by amending the Right to Information Act to exclude personal data from public disclosure, effectively closing access routes to information about state-held personal data.
Why it matters
The DPDPA departs from GDPR principles by granting the government broad and largely unreviewable powers to process personal data without demonstrating necessity or proportionality. This raises serious privacy concerns in a country of 1.4 billion people, as individuals’ fundamental right to privacy recognized by India’s Supreme Court in 2017 is at risk of significant erosion. By excluding key safeguards and transparency mechanisms, the law empowers the state to operate without meaningful accountability in the digital realm.
This regulatory framework creates tensions between the need for data protection and the government’s asserted interests in law enforcement, public order, and research. The law’s open-ended exemptions and five-year 'switch-off' clause that allows the government to suspend provisions as desired underscore the imbalance favoring state power. The Supreme Court is currently reviewing constitutional challenges arguing these exemptions conflict with established privacy jurisprudence, a decision that could shape India’s privacy landscape profoundly.
What to watch next
The Supreme Court of India is deliberating on petitions filed by privacy and transparency advocates, addressing whether the sweeping exemptions and lack of procedural safeguards in the DPDPA comply with constitutional privacy protections and principles of proportionality. The court’s rulings on these challenges will be pivotal in defining the scope of state data powers and individual rights under the new law before its core provisions take effect.
Additionally, stakeholders—including digital rights groups, technology companies, and international observers—will closely monitor how the government exercises its power to exempt data fiduciaries and disapply provisions amid concerns about transparency and potential misuse. Developments in regulatory guidelines and practical application post-enforcement will also shape India’s evolving privacy ecosystem and set precedents for balancing data protection with state interests in emerging digital economies.