Citation: (2017) 10 SCC 1 | Court: Supreme Court of India (nine-judge Constitution Bench) | Decided: 24 August 2017 | Status: Good law -- unanimous nine-judge ruling, the foundation of India's current data protection framework.
In Justice K.S. Puttaswamy (Retd.) v. Union of India, a nine-judge Constitution Bench unanimously held that the right to privacy is a fundamental right protected under Article 21 (life and personal liberty) and Part III of the Constitution generally -- overruling earlier, narrower rulings and directly laying the constitutional foundation that the Digital Personal Data Protection Act, 2023 was later built on.
Case background and the legal question
The case originated as a challenge to the Aadhaar biometric identity scheme, but the Union government's
defense raised a preliminary and much larger question: did the Indian Constitution recognize a fundamental
right to privacy at all? The government relied on two older Supreme Court decisions -- M.P. Sharma (1954,
an eight-judge bench) and Kharak Singh (1962, a six-judge bench) -- which had suggested privacy was not a
guaranteed fundamental right. Because those were larger benches than any that had considered the question
since, a nine-judge bench was specifically constituted to resolve, once and for all, whether privacy is a
fundamental right under the Constitution.
What the Supreme Court held
The Court unanimously held that the right to privacy is a fundamental right, protected as an intrinsic
part of the right to life and personal liberty under Article 21, and as part of the freedoms guaranteed by
Part III of the Constitution more broadly -- expressly overruling the privacy-related observations in both
M.P. Sharma and Kharak Singh. The judgment held that privacy is not an absolute right and can be restricted
by a law that satisfies the tests of legality, legitimate state aim, and proportionality, but any such
restriction must meet that constitutional standard rather than being left to unchecked executive discretion.
The Court also recognized informational privacy -- control over one's own personal data -- as a specific
facet of this right, directly anticipating the need for a comprehensive data protection law.
Why this matters for NRIs, and the case's status today
This judgment is the constitutional bedrock beneath India's Digital Personal Data Protection Act, 2023 and
its 2025 Rules -- the statute NRIs dealing with Indian financial institutions, government portals, and
India-facing digital services now rely on for how their personal data is collected, processed, and protected.
It also matters for Aadhaar, KYC, and biometric-verification requirements NRIs regularly encounter when
opening Indian bank accounts or completing government formalities, since any such requirement must now be
justified against this proportionality standard. The ruling remains unanimous, unchallenged good law, and is
treated as one of the most significant fundamental-rights judgments of the last decade.
Is privacy formally a fundamental right under the Indian Constitution?
Yes -- since K.S. Puttaswamy (2017), the right to privacy is recognized as a fundamental right under
Article 21 and Part III of the Constitution, unanimously confirmed by a nine-judge bench.
Does this mean the government can never require personal data like Aadhaar for a service?
Not necessarily -- the judgment held privacy is not absolute and can be restricted by a law that meets the
tests of legality, legitimate state aim, and proportionality, so a properly justified requirement can still
be constitutionally valid, subject to that standard.
How does this case connect to India's current data protection law?
It provides the constitutional foundation. By recognizing informational privacy -- control over one's own
personal data -- as part of the fundamental right to privacy, the judgment directly anticipated and
underpins the need for the comprehensive data protection framework later enacted as the Digital Personal
Data Protection Act, 2023.
