The Right to Privacy After Justice K.S. Puttaswamy v. Union of India

Since 24 August 2017, privacy has been a fundamental right in India. In Justice K.S. Puttaswamy (Retd.) v. Union of India, a nine-judge bench of the Supreme Court held unanimously that the right to privacy is protected under Article 21 in particular and Part III of the Constitution as a whole. Any state action that intrudes on privacy must now be backed by law, serve a legitimate aim and be proportionate.

This explainer is written for B.A. LL.B. and LL.B. students preparing for constitutional law papers, and for any reader who wants to know what the judgment means for Aadhaar, phone data or personal information held by companies. If you can explain the three-part test and name the two cases it overruled, you have the core of most exam answers on the topic.

What does the Constitution actually say?

The word "privacy" does not appear anywhere in the Constitution. The anchor is Article 21: "No person shall be deprived of his life or personal liberty except according to procedure established by law." In Maneka Gandhi v. Union of India (1978), the Supreme Court read this to mean that the procedure must be fair, just and reasonable, not merely any procedure the legislature chooses. Puttaswamy builds on that reading. The court located privacy within Article 21, and also tied it to the freedoms in Article 19 and equality under Article 14.

How did the privacy question reach nine judges?

The case began as a 2012 writ petition, W.P. (Civil) No. 494 of 2012, filed by Justice K.S. Puttaswamy, a retired judge of the Karnataka High Court, challenging the Aadhaar scheme. The Union argued that privacy was not a fundamental right, relying on two older rulings:

• M.P. Sharma v. Satish Chandra (1954), an eight-judge bench decision on search and seizure.
• Kharak Singh v. State of Uttar Pradesh (1962), a six-judge bench decision on police surveillance and domiciliary visits. It was decided in December 1962 and reported in the 1964 SCR, so you will see both years cited.

On 11 August 2015, a three-judge bench referred the question to a larger bench. A nine-judge bench was constituted on 18 July 2017, heard arguments from 19 July to 2 August 2017, and delivered judgment on 24 August 2017. The reported citation is (2017) 10 SCC 1.

What did Puttaswamy (2017) decide?

1. Privacy is a fundamental right, protected within Article 21 and across Part III.
2. M.P. Sharma and Kharak Singh were overruled to the extent they held otherwise.
3. The court rejected the reasoning of ADM Jabalpur v. Shivkant Shukla (1976), the Emergency case, observing that life and liberty are not bounties conferred by the State.
4. Justice D.Y. Chandrachud, writing for himself, Chief Justice J.S. Khehar and Justices R.K. Agrawal and S. Abdul Nazeer, criticised the reasoning in Suresh Kumar Koushal v. Naz Foundation (2013) on Section 377 of the Indian Penal Code.

Privacy is not absolute. The court accepted that the State can restrict it, but only if three conditions are met:

• Legality: there must be a law authorising the intrusion.
• Legitimate aim: the law must pursue a legitimate state objective.
• Proportionality: there must be a rational connection between the objective and the means chosen.

Learn this three-part test by heart. Nearly every privacy answer you write will turn on it.

How have later cases applied the judgment?

The Aadhaar judgment (2018)

On 26 September 2018, a five-judge bench decided the Aadhaar challenge itself, reported as (2019) 1 SCC 1. By a 4:1 majority, the court upheld the Aadhaar Act, 2016, finding that it met the proportionality test. But it read down Section 57 so that private bodies could not demand Aadhaar authentication, quashed the circular requiring Aadhaar to be linked with mobile numbers, and held that Aadhaar cannot be mandatory for school admission or for exams conducted by CBSE, NEET, JEE and UGC. Justice Chandrachud dissented.

Navtej Singh Johar and Joseph Shine (2018)

Puttaswamy's reasoning on dignity and autonomy was carried forward in Navtej Singh Johar v. Union of India (2018), which decriminalised consensual same-sex relations, and in Joseph Shine v. Union of India (2018), which struck down the offence of adultery. When you cite these, explain the link: both rest on the idea that the State cannot police intimate choices without strong justification.

Where does the law stand in 2026?

The principal statute now is the Digital Personal Data Protection Act, 2023, enacted on 11 August 2023. The Government notified the Digital Personal Data Protection Rules, 2025 in November 2025, with an 18-month phased timeline:

• 13 November 2025: definitions and provisions setting up the Data Protection Board of India came into force.
• 12 November 2026 (one year on): provisions on registration of consent managers.
• 12 May 2027 (eighteen months on): the main duties of data fiduciaries, including notice and consent, children's data, breach handling and the rights of data principals.

Once fully in force, a person can ask a company to access, correct, update or erase their personal data, and the company must respond within 90 days. Breaches must be reported to affected people in plain language. Appeals from the Board lie to TDSAT. So if a student in Nagercoil asks whether she can make an app delete her data today, the honest answer is that the full statutory right arrives with the final phase, though the constitutional right from Puttaswamy binds the State already. Check the official notifications before relying on any date, as phased timelines can be amended.

How should you write about Puttaswamy in an exam?

1. Start with the text. Quote Article 21 and note that privacy is an implied right.
2. Trace the history. M.P. Sharma and Kharak Singh, then Maneka Gandhi, then Puttaswamy.
3. State the holding precisely. Nine judges, unanimous, 24 August 2017, (2017) 10 SCC 1.
4. Apply the test. In a problem question (say, a tenant in Madurai whose landlord hands his ID documents to the police without any legal basis), walk through legality, legitimate aim and proportionality one by one. Remember that the fundamental right binds the State; a purely private dispute will usually fall under statute.
5. Bring it up to date. Mention the 2018 Aadhaar ruling and the DPDP Act and Rules.

Examiners reward accurate case names and years more than long quotations. If you want to see privacy questions in real life, the college legal aid clinic is a good place to start.

Sources

• Supreme Court Observer, Fundamental Right to Privacy: case background, referral dates and holding.
• Supreme Court Observer, judgment in plain English: summary of the 2017 ruling and overruled cases.
• PIB, Government notifies DPDP Rules: official release on the DPDP Rules, 2025.
• AZB and Partners, DPDP phased rollout: dates of each implementation phase.
• SCC Online, Aadhaar judgment report: summary of the 26 September 2018 decision.