India’s privacy regime combines the Supreme Court’s 2017 Puttaswamy ruling—making privacy a fundamental right with a legality-necessity-proportionality test—and the Digital Personal Data Protection Act, 2023 with draft Rules (2025). The law gives individuals rights (access, correction, erasure, consent withdrawal), requires fiduciaries to follow privacy-by-design, mandates breach notification, and allows penalties up to ₹50 crore. Draft Rules add DPIAs, DPOs, parental-consent rules and retention limits. Concerns remain about state exemptions and surveillance (Pegasus, Aadhaar), so continued oversight and stronger safeguards are urged.
