India’s Digital Personal Data Protection Act of 2023 is scheduled to take full effect on May 13, 2027, affecting a population of 1.4 billion. The law is often described as the country’s answer to Europe’s General Data Protection Regulation (GDPR).
The laws have the same cast of characters: data “fiduciaries” who collect personal information, data “principals” whose information it is, notice and consent requirements, a right to erasure, and a regulator empowered to impose fines.
But the similarities end where the state’s powers begin. The GDPR permits restrictions on privacy rights only under specific legal conditions, including necessity and proportionality, and subjects law enforcement data processing to a separate legal framework with its own safeguards. India’s law does the opposite.
It exempts certain law enforcement processing from core data protection obligations without requiring case-by-case authorization, allows the government to exempt entire agencies or classes of data fiduciaries by notification, and permits exemptions for statistical and research purposes subject to conditions. It also gives the government a five-year power to disapply any provision it chooses.
The Indian Supreme Court Supreme Court of India is considering a constitutional challenge to these provisions of the law before its core obligations take effect.
What the exemptions allow
The law recognizes two lawful grounds for processing personal data: consent, or one of a closed list of “legitimate uses.” That list already includes processing by the state to deliver subsidies, benefits and services, and to perform any function under any law. None of that requires consent.
Section 17 then goes further. Under section 17(1)(c), the law’s chapter on the duties of data collectors (apart from a basic duty of compliance and a duty to keep data secure), its chapter on individuals’ rights, and its limits on sending data abroad do not apply to any processing “in the interest of prevention, detection, investigation or prosecution of any offense.” No notification is needed. No official has to show the processing is necessary. Anything that can be described as serving criminal justice is outside the law by its own terms.
Under section 17(2)(a), the central government may exempt any state agency from the entire law by notification, citing sovereignty, security, public order or the prevention of incitement to offenses. The law sets no standard for the notification and no procedure for challenging it.
Under section 17(2)(b), processing for research, archiving or statistical purposes is exempt as long as the data is not used to take a decision about a specific individual and the processor follows six general standards listed in the rules. No authority checks compliance.
Two more provisions complete the picture. Section 17(4) relieves the state of the duty to erase data once its purpose is served, and of an individual’s right to demand erasure. And section 17(5) allows the government, for five years after the law takes effect, to declare that any provision does not apply to any data collector or class of collectors, for as long as it specifies. A law with that clause is a law that can be switched off.
The law also reaches into transparency. Section 44(3) amends India’s Right to Information Act so that any information that “relates to personal information” is exempt from disclosure, removing the public-interest test that previously applied. The route by which a citizen could have discovered what the state holds about them has been closed.
Why the Supreme Court is involved
These are not abstract concerns. In February 2026, the transparency activist Venkatesh Nayak filed a petition in the Supreme Court challenging sections 17(1)(c), 17(2), 33(1), 36 and 44(3) of the law and two of its rules. The case asks the court to decide whether exemptions of this breadth can stand alongside its own 2017 ruling in Puttaswamy v. Union of Indiain which nine judges held that privacy is a fundamental right and that any intrusion must rest on law, pursue a legitimate aim and be proportionate.
A second case shows what is at stake in practice. In August 2026, the court agreed to hear a petition by a member of ParliamentA.A. Rahim, challenging the Delhi police’s use of live facial recognition, smart glasses and fingerprint collection against protesters at Jantar Mantar, the capital’s main protest site, with the data allegedly stored by two private companies. When the new law takes effect, processing of exactly that kind will fall within section 17(1)(c). India’s only comprehensive privacy statute will have nothing to say about it.
The European contrast, in plain terms
The point of comparing India with Europe is not that India should copy Brussels. It is that the European rules show what the Indian text leaves out.
Article 23 of the GDPR lets governments restrict privacy rights for security and law enforcement, but only through “a legislative measure” that respects the essence of fundamental rights and is “necessary and proportionate,” and that measure must spell out its purposes, the categories of data, the scope of the restriction, safeguards against abuse and storage periods where applicable. India’s section 17(1)(c) does not itself impose comparable requirements for a tailored legislative measure, specified safeguards and a necessity-and-proportionality assessment. It operates more like a broad statutory exemption than a restriction tailored to an individual circumstance.
Europe also did not exempt the police from data protection. It gave them their own directivewith purpose limits, retention limits, logging, impact assessments and oversight by an independent authority. India’s Data Protection Board, by contrast, is appointed through a process in which the central government and cannot be relied on to enforce the Act’s ordinary obligations where processing is exempt from the Act.
And where the GDPR treats data revealing race, ethnicity or religion as a special category with extra protection, India’s law has no such category. A 2019 version of the bill had listed caste, tribe and religious or political belief as sensitive data; the 2023 law dropped the category. That matters in a country whose 2027 census will record caste for every resident for the first time since 1931, alongside Aadhaar, voter and passport numbers where available.
Why this matters beyond India
Two audiences outside India should care.
The first is the countries being encouraged to adopt India’s model. India promotes its “digital public infrastructure,” a stack of identity, payments and data-sharing systems, as a template for the Global South, and the 2023 law is presented as the privacy layer that makes it safe. What the law actually shows is that the form of European data protection travels more easily than its safeguards. Consent, notice and fiduciary duties have been transplanted into a statute that mainly governs how citizens deal with companies; the machinery that constrains the state has stayed behind.
The second audience is in Brussels. The EU and India concluded negotiations on a free trade agreement in January 2026, and data flows are the natural next conversation. India has no adequacy decision under the GDPR. After the European Court of Justice’s Schrems II ruling in 2020, adequacy depends not only on the rules a country applies to companies but on the limits it places on access by public authorities and on whether individuals have redress. Those are precisely the areas India’s law exempts in certain circumstances. Anyone expecting the 2023 law to settle that question is reading its first half and skipping its last.
What should happen before May 2027?
The fix is not radical, and there is still time. Every exemption should require a specific law that states its purpose, scope, safeguards and retention period. Police processing should be governed by rules of its own rather than exempted from rules altogether. Statistical and research processing should carry enforceable safeguards and an independent check. Caste and religion should be protected as the sensitive categories they plainly are. And the Act’s time-limited exemption power under section 17(5) should go.
The Supreme Court could invalidate or narrow some of these exemptions if it finds them unconstitutional. Parliament could enact all of it. Either way, the country that has done more than any other to export digital infrastructure to the developing world is about to show whether its privacy law binds the state, or only everyone else.
Source: www.techpolicy.press
