I. Introduction
In November 2025, India notified the Digital Personal Data Protection Rules and completed the framework of its first general data protection law. The parent statute, the Digital Personal Data Protection Act 2023 (DPDP Act), places duties of notice, consent and security on organisations that handle personal data. The same Act, however, allows the Central Government to switch off all of those duties for any State body by issuing a notification.
This matters because the Supreme Court has held that privacy is a fundamental right under Article 21 of the Constitution, and that the State may restrict it only through a law that serves a legitimate aim and is proportionate. A data protection statute is the main tool for turning that holding into working rules. If the statute exempts the State, the protection reaches everyone except the body best placed to intrude.
This article argues that section 17 of the DPDP Act, read with sections 36 and 44(3), does not satisfy the proportionality standard set by the Court. It further argues that Parliament should add statutory criteria, reasoned notifications and independent review before the main provisions take effect. The article is confined to State exemptions. It does not consider children's data, cross-border transfers or penalties. Part II sets out the legal framework. Part III evaluates the exemptions critically. Part IV looks at the European Union. Part V proposes reforms.
II. The Legal Framework
A. The Constitutional Standard
In Justice KS Puttaswamy (Retd) v Union of India, a nine-judge bench held that privacy is an intrinsic part of life and personal liberty under Article 21. The lead opinion of Chandrachud J set out three requirements for any State interference with privacy: a law that authorises it, a legitimate State aim, and proportionality between the means chosen and the aim pursued. The Court applied the same approach when it reviewed the Aadhaar scheme. In Anuradha Bhasin v Union of India, it applied proportionality to restrictions on communication and required that restriction orders rest on sufficient material and remain open to judicial review.
B. The Statutory Scheme
The DPDP Act regulates digital personal data and places its main duties on data fiduciaries, meaning any person who decides the purpose and means of processing. Section 7 lists certain legitimate uses for which processing may go ahead without consent. These include use by the State to provide subsidies, benefits and services, and to perform functions under law. The Rules set standards for some of this State processing.
Section 17(2)(a) goes much further. It disapplies the entire Act to any State instrumentality that the Central Government notifies in the interests of sovereignty and integrity, security of the State, friendly relations with foreign States, public order, or preventing incitement to related cognisable offences. The exemption also covers the Central Government's own processing of any personal data that the notified body hands over. The Act does not require such a notification to give reasons, to be limited in time, or to identify the data it covers, and the Rules set no standards for processing under this provision.
Section 36 allows the Central Government to require the Data Protection Board, any data fiduciary or any intermediary to furnish the information it calls for, for the purposes of the Act. Rule 23 and the Seventh Schedule identify the officers who may make such calls. Section 44(3) separately amends section 8(1)(j) of the Right to Information Act 2005 (RTI Act) so that it exempts information relating to personal information, without the earlier public interest test.
Timing matters. The Rules took effect in stages, and the rules on State processing and calls for information are due to start eighteen months after notification, which is May 2027. Parliament therefore still has room to correct the Act before these powers are used.
III. Critical Evaluation
A. A Law Without Limits
The first Puttaswamy requirement is a law, and a law that restrains must do more than exist. Section 17(2)(a) lists broad grounds, such as public order, and leaves the Central Government to decide which bodies qualify. Nothing in the text asks the government to show that an exemption is necessary or that a narrower one would fail. Once a body is notified, it owes no duty of purpose limitation, accuracy, erasure or security, and the Data Protection Board has nothing to enforce against it.
B. Exemption Without Proportionality
National security is plainly a legitimate aim, and no serious critic denies it. The difficulty lies in the third requirement. A measure is proportionate only if it goes no further than the aim requires. Removing the whole Act from a notified body goes further than any security aim needs. An intelligence agency can pursue its objectives and still be bound to protect the data it holds from leaks. Under the Act, even the duty to take reasonable security safeguards falls away. A breach of a security database harms the people in it just as much as a breach at a private company.
Earlier drafts did better. The 2018 Bill allowed processing in the interests of State security only if a law made by Parliament authorised it and the processing was necessary for, and proportionate to, that interest. The 2019 Bill moved to executive orders, but it required the Central Government to be satisfied that an exemption was necessary or expedient and to record its reasons in writing. The 2023 Act contains neither the necessity language nor the duty to record reasons.
C. Oversight Held by the Same Hand
The Central Government also appoints the Board that would supervise compliance. The same executive therefore decides who is exempt, can demand information from private firms under section 36, and chooses the body that reviews data protection. The Seventh Schedule gives some structure by naming purposes and authorised officers. Beyond the courts' general writ jurisdiction, however, the Act offers no independent check on the decision to notify a body or to call for information. Anuradha Bhasin suggests that this is not enough, because restrictions on rights must be open to scrutiny.
D. Section 44(3) and Transparency
Section 44(3) turns a privacy rule into a shield for officials. Before the amendment, section 8(1)(j) of the RTI Act allowed a public authority to refuse personal information only if it had no link to public activity or would cause an unwarranted invasion of privacy, and it allowed disclosure where a larger public interest required it. The new clause exempts information that relates to personal information, and nothing more. On its face, a record of an official's conduct could be withheld because it names a person.
These provisions are now under challenge. In February 2026 the Supreme Court issued notice on petitions against the DPDP framework but declined to stay it. In August 2026 it asked the Centre to file its reply.
E. The Government's Answer
Defenders of the exemptions can say that security agencies cannot work if they must seek consent or give notice. On section 44(3), the Ministry has argued that the change aligns the RTI Act with the right to privacy and that section 8(2) of the RTI Act still permits disclosure where the public interest outweighs the harm. Both points have some force, but neither answers the objection. The first justifies narrow exemptions from specific duties, such as notice to a suspect, and not exemption from the whole Act. The second overlooks that section 8(2) is a general override, whereas the earlier clause tested privacy against public interest at the first step. It is submitted that a general override is a weaker protection than a specific test built into the exemption itself.
IV. The European Union
The General Data Protection Regulation (GDPR) offers a useful contrast. Article 23 allows restrictions on data subject rights and controller duties for aims such as national security and public security, but only through a legislative measure. That measure must respect the essence of fundamental rights and be a necessary and proportionate step in a democratic society. It must also contain specific provisions on matters such as purposes, categories of data, the scope of the restriction, safeguards against abuse and the storage period. Law enforcement processing by competent authorities falls outside the GDPR and is governed by a separate Directive.
The Court of Justice has also treated redress as part of proportionality. In Schrems II, it found that United States surveillance programmes were not limited to what is strictly necessary and gave affected people no effective remedy. The European model therefore turns on two features that the DPDP Act lacks for exempted processing: a statute that itself sets limits and safeguards, and a route for the individual to seek redress. India need not copy the GDPR. The point is that proportionality needs working parts.
V. Proposals for Reform
Reform need not weaken security. It needs to make the exemption earn its place. Four changes would achieve this.
First, section 17(2)(a) should list the specific provisions that a notified body may disapply, and it should keep the duties to take security safeguards and to report breaches in force. Second, each notification should state its reasons, identify its purpose and the categories of data involved, carry a time limit, and be laid before Parliament. These steps follow from the reasons requirement in the 2019 Bill and from the insistence in Anuradha Bhasin on reasoned orders that are open to review.
Third, an independent body, such as a panel led by a retired judge or a parliamentary committee, should review notifications and section 36 calls at regular intervals. The Board is unsuited to this task because the Central Government appoints it. Fourth, section 44(3) should be amended to restore the public interest test in section 8(1)(j) of the RTI Act, so that privacy and transparency are balanced and not ranked.
The timetable helps. Because the rules on State processing and calls for information start in 2027, Parliament can make these changes before any notification is issued.
VI. Conclusion
This article examined how the DPDP Act treats the State and found the treatment wanting. Section 17(2)(a) lets the Central Government remove a chosen body from the whole Act without stating reasons, fixing a duration or facing independent review. Section 36 adds a broad power to demand information, and section 44(3) narrows public access to records by dropping the public interest test. Measured against the standard of legality, legitimate aim and proportionality that the Supreme Court has laid down, the exemptions are broader than any security aim needs. The comparison with the European Union shows that restrictions on data rights can sit alongside strong safeguards when the legislature sets limits in advance and gives individuals a remedy.
The thesis therefore stands. The exemptions in their present form do not meet the proportionality standard. The article recommends four reforms: partial exemptions that keep security and breach duties, reasoned and time-limited notifications laid before Parliament, independent review of notifications and calls for information, and restoration of the public interest test in the RTI Act.
The Supreme Court has the pending petitions before it and may address some of these concerns. Parliament should not wait for that outcome. A data protection law that stops at the door of the State protects people from private firms but leaves them exposed to the actor with the most power over their lives. Closing that gap is what the right to privacy requires.
References
Table of Cases
Anuradha Bhasin v Union of India (2020) 3 SCC 637
Case C-311/18 Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems ECLI:EU:C:2020:559
Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1
Justice KS Puttaswamy (Retd) v Union of India (2019) 1 SCC 1
The Reporters Collective Trust v Union of India WP(C) 211/2026 (SC, 16 February 2026)
Table of Legislation
Constitution of India 1950
Digital Personal Data Protection Act 2023
Digital Personal Data Protection Rules 2025
Directive (EU) 2016/680 [2016] OJ L119/89
Personal Data Protection Bill 2018
Personal Data Protection Bill 2019
Regulation (EU) 2016/679 (General Data Protection Regulation) [2016] OJ L119/1
Right to Information Act 2005
Bibliography
Centre for Internet and Society, 'Comments to the Personal Data Protection Bill 2019' (CIS) https://cis-india.org/internet-governance/blog/comments-to-the-personal-data-protection-bill-2019 accessed 4 October 2026
Communications Today, 'SC Seeks Centre's Reply on RTI Changes Introduced through DPDP Act' (Communications Today, 8 August 2026) https://www.communicationstoday.co.in/sc-seeks-centres-reply-on-rti-changes-introduced-through-dpdp-act/ accessed 4 October 2026
Internet Freedom Foundation, 'Supreme Court Issues Notice on Constitutional Challenge to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025' (IFF) https://internetfreedom.in/supreme-court-issues-notice-on-constitutional-challenge-to-the-digital-personal-data-protection-act-2023-and-the-digital-personal-data-protection-rules-2025/ accessed 4 October 2026
S.S. Rana and Co, 'DPDP Act Upholds Privacy while preserving transparency under Right to Information Act' (S.S. Rana and Co) https://ssrana.in/?p=41174 accessed 4 October 2026
Editorial and academic note: This sample is provided for educational and writing-reference purposes. Please independently verify authorities, citations, dates and current law before relying on or citing any proposition. Submission does not guarantee publication.