Does India need stronger data privacy and surveillance oversight laws?

The Digital Personal Data Protection (DPDP) Act, 2023 is India's first comprehensive data protection law, setting rules for how companies and the government collect and use personal data. It followed a 2017 Supreme Court ruling that privacy is a fundamental right. Critics argue the Act's broad government exemptions undercut the protection it is meant to provide, particularly around state surveillance.

The push for a data protection law followed the Supreme Court's 2017 ruling in Justice K. S. Puttaswamy v. Union of India, which recognised privacy as a fundamental right under the Constitution. An expert committee led by former judge B. N. Srikrishna produced the first draft framework in 2017-18, but the law that eventually passed in 2023 diverged from that draft in significant ways.

The DPDP Act allows the central government to exempt government agencies from its provisions on grounds including national security, public order, and relations with foreign states, exemptions that critics, including Justice Srikrishna himself, have said are broad and not tightly bounded by clear criteria. The Act also does not include a journalistic-purpose exemption that earlier draft versions had contained, a point the Editors Guild of India has objected to. Separately, reporting on the use of spyware such as Pegasus against journalists and opposition figures has raised concerns about surveillance that exist outside the data protection framework entirely.

• Broad, loosely bounded government exemptions undercut the core purpose of a data protection law if the state itself is the largest potential violator of citizens' privacy.
• Without independent oversight of surveillance specifically (as opposed to general data handling), citizens have limited recourse if state surveillance powers are misused.
• Removing the journalistic-purpose exemption present in earlier drafts could expose investigative reporting that relies on personal data to legal risk.

• The DPDP Act is still India's first dedicated data protection law; supporters argue incremental progress with future amendment is preferable to delaying any law in pursuit of a perfect one.
• National security and public order exemptions exist in most countries' data protection regimes in some form; the question is one of degree and oversight, not whether exemptions should exist at all.
• The law is still being implemented through subsidiary rules, leaving room for procedural safeguards to be added administratively even without new primary legislation.

The European Union's General Data Protection Regulation (GDPR) is the most-cited global benchmark, and includes national security exemptions of its own, but pairs them with independent data protection authorities and detailed judicial oversight mechanisms that critics argue India's framework lacks in comparable strength. The United States has no single comprehensive federal privacy law and instead surveillance oversight runs through a separate, specialised system, the Foreign Intelligence Surveillance Court, illustrating that dedicated surveillance oversight and general data protection law are often treated as related but distinct problems, a distinction India's current framework has not fully separated out.

The DPDP Act passed with relatively broad parliamentary support, but opposition MPs raised objections during debate specifically over the scope of government exemptions. Civil liberties and digital rights groups have been the most consistent critics, while the government's position is that national security exemptions are necessary and that India's law is broadly comparable to international standards.

This question sits firmly on the Authority axis: support for stronger, independent privacy and surveillance oversight reads as libertarian, while comfort with broad state data-collection powers reads as more authoritarian.