Right to Privacy as a Fundamental Right (Article 21)

The right to privacy means every person has the right to be left alone and to control information about themselves: their body, their home, their personal choices and their personal data. In India, this is a fundamental right, guaranteed by the Constitution. The Supreme Court declared this in 2017 in the case Justice K.S. Puttaswamy (Retd.) v. Union of India.

Privacy is protected mainly as part of the right to life and personal liberty under Article 21, and also as part of the freedoms in Part III of the Constitution.

Why does it matter?

Think of your phone. It knows where you go, who you talk to, what you buy and what you search for. Your Aadhaar number links to your bank account and mobile number. If the government or a company can freely collect, use or sell all this, they can track, judge or exploit you. Privacy protects your dignity and your freedom to think, speak and live as you choose, without someone always watching. Without it, other freedoms such as free speech become weak, because people stop speaking freely when they feel watched.

Is the word "privacy" in the Constitution?

No. The Constitution does not use the word "privacy" anywhere. The courts found it inside other rights, mainly Article 21, which says no person shall be deprived of life or personal liberty except according to procedure established by law. Over the years, the Supreme Court read "life" in Article 21 as a life with dignity, not just survival. Privacy grew out of that idea.

Where did it come from? The long road in court

• M.P. Sharma v. Satish Chandra (1954): An eight-judge bench said that the Constitution did not recognise a right to privacy, in the context of search and seizure of documents.
• Kharak Singh v. State of Uttar Pradesh (1962): A six-judge bench struck down night-time police visits to a person's home as violating personal liberty, but the majority said privacy was not a guaranteed right.
• Govind v. State of Madhya Pradesh (1975): The Court accepted that a right to privacy could be drawn from Article 21, but said it was not absolute.
• R. Rajagopal v. State of Tamil Nadu (1994): Also called the "Auto Shanker case". The Court linked privacy to the right to be left alone, including in matters of family, marriage and personal life.
• PUCL v. Union of India (1997): On telephone tapping. The Court said a phone conversation at home or office is part of privacy. It laid down safeguards for tapping under Section 5(2) of the Indian Telegraph Act, 1885.

Because two larger benches (1954 and 1962) had said there was no such right, the question remained unsettled. It came up again during the challenge to Aadhaar, when the government argued that privacy was not a fundamental right.

The Puttaswamy judgment (2017)

Justice K.S. Puttaswamy, a retired judge of the Karnataka High Court, challenged the Aadhaar scheme. The privacy question was sent to a nine-judge bench, headed by Chief Justice J.S. Khehar. On 24 August 2017, the bench ruled unanimously (9:0):

• The right to privacy is a fundamental right, protected under Article 21 and as part of the freedoms in Part III, including Articles 14 and 19.
• It overruled M.P. Sharma (1954) and Kharak Singh (1962) to the extent they said there was no such right.
• Privacy includes bodily privacy (your body), informational privacy (your data) and decisional privacy (your personal choices, such as whom to marry or what to eat).
• The Court asked the government to create a strong law to protect personal data.

Is privacy absolute? The three-part test

No. The State can limit privacy, but only if it passes a test. Any limit must meet all three conditions:

1. Legality: There must be a law that allows it. An order or a practice without law is not enough.
2. Legitimate aim: The law must have a proper purpose, such as national security, preventing crime or giving welfare benefits to the right people.
3. Proportionality: The limit must be reasonable and not more than needed. The State should use the least intrusive way to reach its aim. Think of it like using a key to open a door instead of breaking the wall.

Justice Sanjay Kishan Kaul also stressed procedural safeguards against misuse, so some describe the test as having four parts.

What happened next?

• Puttaswamy II (Aadhaar case), September 2018: A five-judge bench upheld the Aadhaar scheme by a 4:1 majority, but with limits. It struck down Section 57 of the Aadhaar Act, which had allowed private companies to use Aadhaar for verification. Aadhaar was no longer compulsory for bank accounts, mobile connections or school admissions.
• Navtej Singh Johar (2018) and Joseph Shine (2018): The Court used privacy and dignity to decriminalise consensual same-sex relations and adultery.
• Pegasus spyware case (2021): In Manohar Lal Sharma v. Union of India, the Court set up a technical committee, overseen by retired Justice R.V. Raveendran, to examine claims of illegal phone surveillance. It said the State does not get a "free pass" every time it raises national security.
• Data protection law: Following Puttaswamy, an expert committee under Justice B.N. Srikrishna drafted a data protection bill in 2018. After several versions, Parliament passed the Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025 were notified in November 2025.

How is privacy enforced in practice?

• Against the State: A person can go to the Supreme Court under Article 32 or a High Court under Article 226 if the government violates their privacy. Courts can strike down laws or orders and give directions, as the Kerala High Court did.
• Against private companies: Fundamental rights mostly bind the State. So privacy against companies is protected mainly through laws such as the DPDP Act, 2023 and the Information Technology Act, 2000.
• Regulator: Under the DPDP Act, the Data Protection Board of India is meant to hear complaints about data breaches and impose penalties. If it is not working, the law cannot be enforced on the ground.

Commonly confused concepts

• Privacy vs data protection: Privacy is the broad fundamental right. Data protection is one part of it (informational privacy), given effect through a specific law (the DPDP Act).
• Article 21 vs Article 32 vs Article 226: Article 21 is the right itself (life and personal liberty). Article 32 lets you go to the Supreme Court to enforce fundamental rights. Article 226 lets you go to a High Court for fundamental rights and also for other legal rights.
• Puttaswamy I (2017) vs Puttaswamy II (2018): The 2017 nine-judge case declared privacy a fundamental right. The 2018 five-judge case decided whether the Aadhaar scheme was valid.
• Procedure established by law vs due process of law: "Procedure established by law" (the words in Article 21) originally meant any procedure laid down by a valid law. Since Maneka Gandhi (1978), courts require that the procedure must also be fair, just and reasonable, which is close to the American idea of "due process".
• Right to privacy vs right to information: RTI gives citizens access to government information. Privacy protects personal information. The two can clash, so the RTI Act has an exemption for personal information.

Issues, criticism and the way forward

• Wide government exemptions: The DPDP Act lets the government exempt its own agencies from the law on grounds such as national security and public order. Critics say this could weaken the Puttaswamy proportionality test. The government's position is that these exemptions are needed for security and are subject to safeguards.
• Surveillance: India has no single law that gives judicial or parliamentary oversight over surveillance by agencies. Experts have repeatedly suggested such oversight.
• Facial recognition: Systems like Digi Yatra and police face-recognition tools collect biometric data (face, fingerprints). Critics worry about consent, storage and misuse. Supporters point to speed and security benefits.
• Weak enforcement: A right needs a working regulator. Delays in setting up the Data Protection Board leave people without an easy way to complain against data misuse.
• RTI dilution concern: The DPDP Act amended the RTI Act's personal information exemption. Transparency activists say this could block access to information about public officials. The government says it balances privacy and transparency.
• Way forward: Experts suggest a fully independent and working Data Protection Board, a surveillance law with oversight, narrow and justified exemptions, and public awareness so people know their data rights.

Concepts to Know

• Fundamental rights: Basic rights in Part III of the Constitution (Articles 12 to 35). Courts can enforce them directly against the State.
• Bench: A group of judges hearing a case. A larger bench (more judges) can overrule a smaller bench's decision.
• Overrule: When a larger bench says an earlier decision was wrong, so it no longer applies as law.
• Unanimous: All judges agree on the decision.
• Biometric data: Information about a person's body that can identify them, such as fingerprints, iris scans or face features.
• Surveillance: Watching or monitoring people, for example by tapping phones or tracking online activity.
• Proportionality: The idea that a limit on a right must not be bigger than needed to achieve its purpose.