FROM CONTRACT TO CONSTITUTION: MAPPING THE EVOLUTION OF DATA PROTECTION LAW IN INDIA

For most of its digital history, India protected personal data almost by accident. The earliest safeguards came from a single compensation clause in the Information Technology Act, 2000 and from whatever a company chose to promise in its privacy policy. This paper traces how that contract-based model gave way to a rights-based one. It follows two connected tracks. The first is constitutional: the slow recognition of privacy by the Supreme Court, which ended in the nine-judge bench decision in Justice K.S. Puttaswamy v. Union of India. The second is legislative: the SPDI Rules of 2011, the Srikrishna Committee Report, the Personal Data Protection Bill of 2019 and its withdrawal in 2022, followed by the Digital Personal Data Protection Act, 2023 and the Rules notified in November 2025. With this history in place, the paper looks closely at two features of the new framework that are still at an early stage. These are the working of notice and consent for a very diverse body of users and the independence and capacity of the Data Protection Board of India. The paper closes with a set of practical reforms. It argues that the phased roll-out running until May 2027 gives the framework a real chance to live up to the constitutional promise made in Puttaswamy.