The right to privacy: Puttaswamy and how to use it
How the Supreme Court made privacy a fundamental right in 2017, the test the State must pass to intrude, and how to protect yourself today.
In short
- Privacy is a fundamental right of every person in India, part of the right to life and liberty under Art 21 (Justice K.S. Puttaswamy v. Union of India, 2017, nine judges, unanimous).
- The State may intrude on privacy only if there is a law, a legitimate aim, and the intrusion is proportionate. When an official asks for your data, ask: under which law, and for what purpose?
- Against the government you can go to the High Court Art 226 or Supreme Court Art 32. Against companies and individuals, use specific laws: the IT Act, the BNS and, as it comes into force, the DPDP Act, 2023.
- If your private images or data are misused online, report on 1930 or cybercrime.gov.in.
Your phone knows where you slept last night. Your bank knows what you bought. An app may know your heartbeat. Governments and companies collect more about you than any neighbour ever could. In 2017 the Supreme Court gave a clear answer to who may look into your life, and on what terms: privacy is a fundamental right. This guide explains what that means and how to use it.
The case that settled it
Justice K.S. Puttaswamy v. Union of India began as a challenge to Aadhaar. The government argued that the Constitution contains no right to privacy, relying on older judgments from 1954 (M.P. Sharma) and 1962 (Kharak Singh). On 24 August 2017, a bench of nine judges unanimously held that privacy is a fundamental right. It is part of the right to life and personal liberty in Art 21 and also flows from the freedoms in Art 19 and equality in Art 14. The older judgments were overruled to that extent.
What privacy covers
The Court gave no closed list, but recognised several layers:
- Your body: control over what happens to it, including medical and reproductive choices.
- Your information: control over personal data such as health records, finances and messages ("informational privacy").
- Your choices: whom to love, what to eat, what to believe, how to live.
- Your space: the home and private places where you are entitled to be left alone.
The Court stressed that privacy belongs equally to rich and poor, and rejected the idea that people who need welfare do not care about it.
When the State can limit privacy
Privacy is not absolute. A State intrusion must pass a three-part test:
- Legality: a law must authorise it. An executive instruction or a police habit is not enough.
- Legitimate aim: the law must serve a proper purpose, such as national security, preventing crime or delivering welfare.
- Proportionality: the intrusion must be no more than necessary for that aim, with a fair balance between harm and benefit.
The judges also emphasised procedural safeguards against abuse. Courts now apply this test to surveillance, data collection, searches and phone seizures. Phone tapping, for instance, is allowed only under the procedure in the telecom law and its rules, with orders from a senior official.
What followed
- Navtej Singh Johar v. Union of India (2018): relying on privacy and dignity, the Court decriminalised consensual same-sex relations between adults.
- Joseph Shine v. Union of India (2018): the Court struck down the old adultery offence as an intrusion into personal autonomy.
- K.S. Puttaswamy v. Union of India (2018), the Aadhaar case: a five-judge bench upheld Aadhaar for government subsidies and benefits but struck down the provision letting private companies demand it, and held it cannot be made compulsory for bank accounts or mobile connections.
- Data protection law: the 2017 judgment urged Parliament to protect personal data. The Digital Personal Data Protection Act, 2023 followed. Its Rules were notified on 13 November 2025; as of October 2026 only the provisions setting up the Data Protection Board are in force, and most duties on companies and your rights under the Act are due from 13 May 2027.
- RTI and privacy: since 13 November 2025, an amendment made by the DPDP Act bars disclosure of personal information under the RTI Act's personal-information exemption, removing the earlier public-interest override. Petitions challenging this change are pending before the Supreme Court as of 2026.
Some High Courts have also ordered names to be masked in online judgments or search results (a "right to be forgotten"), but the Supreme Court has not yet laid down a settled rule.
Step by step: using the right
- Give only what is needed. Ask why a field is mandatory. Offer a masked Aadhaar or another ID where full details are not required.
- Ask for the legal basis in writing when a government office demands data, a search, or access to your phone.
- Complain upward. Write to the head of the office, then use CPGRAMS (pgportal.gov.in).
- For online misuse of photos, chats or data, report on 1930 or cybercrime.gov.in. Sharing private images without consent is an offence Sec 66E IT Act, as are voyeurism Sec 77 BNS and online stalking Sec 78 BNS.
- Go to court through a writ petition under Art 226 or Art 32 if the State intrudes without law or beyond what is necessary. Free legal aid: 15100.
Farah, 20, lives in a government college hostel. The hostel office posts a list of students' names, phone numbers, caste and home addresses on a public WhatsApp group and the college website. Farah writes to the principal asking which rule requires public display, pointing out that the Puttaswamy test needs a law, a legitimate aim and proportionality, and that strangers are now calling students. When nothing happens, she files a grievance on CPGRAMS. The college removes the list and shares contact details only with wardens.
A fundamental right is directly enforceable against the State, not against your landlord, employer or an app. Against private parties you must rely on specific laws such as the IT Act, the BNS and, once in force, the DPDP Act. Also, the DPDP Act's main rights are not yet in force as of October 2026.
Where to go
- The office or company asking for your data: ask for the legal basis and grievance officer in writing.
- Cyber misuse: 1930 and cybercrime.gov.in; women's helpline 181.
- Government grievances: pgportal.gov.in.
- Courts: High Court (Art 226) or Supreme Court (Art 32). Free legal aid: 15100 (nalsa.gov.in).
Common questions
Is privacy a fundamental right in India?
Yes. In Justice K.S. Puttaswamy v. Union of India (2017), a nine-judge bench of the Supreme Court unanimously held that privacy is a fundamental right, mainly under Article 21. It covers your body, personal information, intimate choices and private spaces.
Can the government ever invade my privacy?
Only if it passes the Puttaswamy test: there must be a law authorising it, a legitimate aim, and the intrusion must be proportionate to that aim, with safeguards against abuse. An intrusion without a law, or far beyond what is needed, can be challenged in the High Court or Supreme Court.
Can I enforce my right to privacy against a private company?
Not directly as a fundamental right. You use specific laws instead: the IT Act and BNS for offences such as sharing private images or stalking, and the Digital Personal Data Protection Act, 2023, whose main rights are due to apply from 13 May 2027.
Is there a right to be forgotten in India?
Not yet as a settled rule. Some High Courts have ordered names to be masked in online judgments or removed from search results in particular cases, but the Supreme Court has not laid down a general rule as of 2026.
This article is general information for awareness, not legal advice. For your situation, consult an advocate or call free legal aid at 15100.
