Right to Privacy for CLAT: Puttaswamy and the DPDP Act

📑 On this page

⚡ The short answer

The right to privacy is a fundamental right, part of the right to life and personal liberty (Puttaswamy, 2017). It covers your body, your information and your choices. It isn't absolute: the State may intrude only under a law, for a legitimate aim, by proportionate means. Against private companies, the data protection law does the work.

🎬 The 30-second story

The gym that sold its member list

“Name, phone, Aadhaar copy. Just for your membership card!”

🏋️

Kabir

Zoya joins Kabir's gym.

“Why is a loan app calling me?”

📱

Zoya

Kabir had sold his member list.

“That's my privacy. I'm filing an Article 21 writ!”

⚖️

Zoya

Furious, and half right.

“Against a gym? Fundamental rights are a shield against the State.”

🤔

Rohan

So has Zoya no remedy?

Tara's ruling: She has one, just not that one. Kabir's gym isn't the State, so the data protection law applies: Zoya consented to a membership, not marketing. She can withdraw consent, demand erasure and complain to the Data Protection Board.

What is the right to privacy?

Privacy is a zone the world can't enter without good reason: your body, your home, facts about you and choices about your own life. The Constitution never uses the word. In 2017 nine judges held that it lives inside life and personal liberty, and inside the other freedoms too.

🧩 At a glance

Three faces of privacy

🫀Bodily

Your body and home: no forced tests, no midnight knock.

📂Informational

Health records, bank details, location, call logs.

🧭Decisional

Whom to love or marry, whether to have a child.

A CLAT passage puts it like this: "Privacy is fundamental but not absolute; any intrusion must be backed by law, pursue a legitimate aim and be proportionate." Run the facts through each limb in order and stop at the first that fails.

📌 What CLAT actually expects

CLAT 2024 and 2025 both gave you a data protection passage. Read each exemption and consent rule literally: what it allows, for whom, for what purpose.

How did privacy become a fundamental right?

🕒 Timeline

From 'no such right' to a nine-judge yes

🔎
1954

M.P. Sharma

Search and seizure upheld; no constitutional privacy right to stop it.
🚪
1962

Kharak Singh

Night visits to a suspect's home struck down; shadowing allowed.
👁️
1975

Gobind

Assumes a privacy right, but surveillance allowed for genuine dangers.
📰
1994

R. Rajagopal

Privacy is the 'right to be let alone'.
🧠
2010

Selvi

Forced narco and lie-detector tests struck down.
🔐
2017

Puttaswamy I

Privacy is fundamental; the contrary parts of M.P. Sharma and Kharak Singh overruled.
🆔
2018

Puttaswamy II

Aadhaar for welfare upheld; some uses struck down.
💾
2023

Data protection law

Tested in CLAT 2024 and 2025.

When can the State invade your privacy?

The State checks bags at airports and taps terror suspects' phones. Puttaswamy allows intrusion that clears three hurdles; the Aadhaar case split the last into four sharper checks.

🧮 The formula

The three-part test

📜

A law

not a mere circular

🎯

A legitimate aim

security, crime, welfare

⚖️

Proportionate means

no heavier than needed

✅

A valid intrusion

🧭 Decision flow

Does this intrusion survive?

❓ Is it backed by a law?

An executive circular alone won't do.

No →

Fails legality

The order to link every SIM to Aadhaar fell here.

Yes ↓

❓ Does it pursue a legitimate aim?

No →

Fails: no legitimate aim

Yes ↓

❓ Does the measure actually help achieve the aim?

No →

Fails suitability

Yes ↓

❓ Is there a less intrusive way that works as well?

Yes →

Fails necessity

A bag check, not a strip search.

No ↓

❓ Is the harm out of proportion to the gain?

Yes →

Fails balancing

No →

Valid intrusion

With safeguards against abuse.

Order matters. A noble aim can't rescue an intrusion with no law behind it. That's why one Aadhaar number survived some uses and died in others.

Use of Aadhaar	Result	Why
Welfare subsidies from public money	✅ Upheld	Law, real aim, proportionate
Linking PAN for income tax	✅ Upheld	Law aimed at tax evasion
Private companies verifying you	❌ Struck down	Invited commercial exploitation
Linking every mobile SIM	❌ Quashed	Only a circular: no law
Linking every bank account	❌ Struck down	Disproportionate: everyone treated as a suspect
School admission, NEET, JEE	🚫 Not mandatory	Not a subsidy; no law requires it

→ scroll to see more

Is every fact about you private?

No. The Aadhaar majority protected matters where you have a reasonable expectation of privacy. Your face in a crowd isn't secret; your medical file is. The more intimate the data, the stronger the justification the State needs.

🎚️ The scale

How strong is your privacy claim?

← Weak expectationCore privacy →

Public face

Name on a door, face at a rally

Contact data

Phone, email, address

Financial

Bank details, loans

Health, biometrics

Medical history, fingerprints

Mind

Forced narco tests

e.g. Selvi: off-limits

Can the press publish facts about your life?

R. Rajagopal, about a magazine printing a death-row convict's autobiography, set rules CLAT loves:

✓Private life needs consent: family, marriage, motherhood, education, true or not.
✓Public records are fair game, except that a victim of sexual assault, kidnapping or abduction must not be named.
✓Officials can't hide official conduct, unless the publisher showed reckless disregard for truth.
✓Invite controversy, lose some cover.

Does privacy protect you against companies too?

Fundamental rights mainly bind the State. Puttaswamy warned that platforms can know you better than any government, and asked for a data protection law. The DPDP Act, 2023 binds companies and government alike, with wide carve-outs for government.

⚔️ Side by side

Two rulebooks for one right

🏛️Constitutional right

a shield against the State

•Writ in a High Court or the Supreme Court

💾Data protection law

binds anyone handling digital personal data

•Grievance officer, then the Board

Test	Constitutional right	Data protection law
The test	Law, aim, proportionality	Consent or a legitimate use
What you get	Action quashed	A penalty on the company, paid to the government

Kabir's gym is a data fiduciary, not 'the State'.

What does the data protection law say?

🔗 Who owes whom

Who's who in data protection

Data Principal → Data Fiduciary: gives consent
Data Fiduciary → Data Processor: hands data to — fiduciary stays responsible
Data Principal → Protection Board: complains
Protection Board → Data Fiduciary: penalises

Consent must be free, specific, informed, unconditional and unambiguous, by a clear affirmative action, for a stated purpose, covering only the data that purpose needs. A pre-ticked box isn't affirmative; 'any purpose' isn't specific.

Some legitimate uses need no consent: data you volunteered for a stated purpose, State benefits, legal duties and court orders, medical emergencies, epidemics and disasters, some employment needs.

🧩 At a glance

Your rights as a data principal

📋Know

A summary of your data and who got it.

✏️Correct

Fix, complete or update it.

🗑️Erase

Once the purpose or consent ends.

↩️Withdraw

As easily as given; works going forward.

📣Complain

Grievance officer, then the Board.

🧑‍🤝‍🧑Nominate

Someone to act on death or incapacity.

Children (under 18) need verifiable parental consent, and may not be tracked or targeted with ads. You have duties too: no impersonation, no false complaints.

Where does the government get a pass?

Processing to prevent, detect, investigate or prosecute offences is exempt; so are notified security agencies, research and statistics, and tracing a loan defaulter's assets. The CLAT 2024 passage called these carve-outs too wide. Challenges are pending in the Supreme Court.

⚠️ Read the exemption, not the vibe

An exemption covers only its stated purpose. Tracing a defaulter's assets and liabilities doesn't let the bank read his family's medical history. Outside the purpose, the normal rules snap back.

Which cases should you know for privacy?

🚪

Landmark case · 1962 · Supreme Court

Kharak Singh v State of UP

📋

What happened

Released in a dacoity case for want of evidence, Kharak Singh was put under police surveillance: night visits, picketing, his movements logged.

❓

The question

Does this violate his personal liberty?

🔨

What the court held

Night visits to his home, backed by no law, were struck down. The rest survived: privacy, said the majority, isn't a guaranteed right. Justice Subba Rao dissented.

What CLAT takes from it: The dissent became the law in 2017.

🔐

Landmark case · 2017 · Supreme Court (9 judges)

Justice K.S. Puttaswamy v Union of India

📋

What happened

A retired judge challenged Aadhaar. The government said older benches had found no fundamental right to privacy.

❓

The question

Is privacy a fundamental right?

🔨

What the court held

Yes, unanimously: an intrinsic part of life and personal liberty and the Part III freedoms. Contrary parts of M.P. Sharma and Kharak Singh overruled.

What CLAT takes from it: Privacy is about dignity and autonomy. Intrusion needs law, aim and proportionality.

🆔

Landmark case · 2018 · Supreme Court (5 judges)

Puttaswamy (Aadhaar) v Union of India

📋

What happened

The Aadhaar Act itself: biometrics of a billion people, tied to welfare, tax, banks and SIMs.

❓

The question

Does the scheme pass the privacy test?

🔨

What the court held

By 4:1, welfare and PAN uses passed; private-company use and forced bank and SIM linking did not. Justice Chandrachud would have struck down the whole Act.

What CLAT takes from it: Same test, different results. Apply each limb to each use.

How has CLAT asked privacy?

📝 Asked in CLAT 2024 · Q73 Reading an exemption

…the law isn't balanced, because it provides wide exemptions to the processing of personal data to the government. For instance, data can be processed "in the interest of prevention, detection, investigation or prosecution of any offence … in India." … The government is not bound by purpose limitations, allowing data collected for one specified purpose be used for a new, incompatible purpose, which stands in contrast to the regulations imposed on businesses.

Suppose the DPDPA, 2023 provided exemption for the processing of personal data for the purpose of ascertaining the financial position of any person who has defaulted in payment of amount due on loan taken from a nationalised bank. Mr. X Commits a default in repayment of EMI of loan taken from a nationalized bank.

AThe bank can demand access to and process the personal data of Mr. X relating to family history of ailments from which Mr. X or his family was suffering.

BThe bank can process the personal data of Mr. X viz., the particulars of the family, wife, children, brothers etc.

CThe bank can process the data of Mr. X for the purpose of ascertaining the assets and liabilities of the defaulter.

DAll of the above.

Reveal answer + reasoning

Answer: C

The exemption is defined by its purpose: a defaulter's financial position. His assets and liabilities fit exactly; anything beyond falls back under normal data protection.

Why the others fail

A — Family illnesses say nothing about his finances.
B — Relatives' details are other people's data, not his finances.
D — A and B fail, so D fails.

📝 Asked in CLAT 2025 · Q81 Withdrawing consent

The Supreme Court of India declared that the right to privacy is a fundamental right… The entity processing data can do so either by taking the concerned individual's consent or for "legitimate uses"… The law requires that an individual's consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and for a specific purpose… Individuals have the right to withdraw consent if consent is the ground on which data is being processed.

A social media platform processes user data based on the consent given during account creation. A user now wishes to withdraw consent to process their data. Under the digital personal data protection law in India, what must the platform do?

ARefuse to accept the withdrawal request since consent was already given

BComply with the legal requirements and stop processing the data

CContinue processing the data but notify the user

DAllow withdrawal only after 30 days

Reveal answer + reasoning

Answer: B

Consent is the only ground here, and the passage gives a right to withdraw it, so the platform must stop. (Under the Act, processing before withdrawal stays lawful; only future processing ends.)

Why the others fail

A — Consent isn't a lifetime licence; that's the point of withdrawal.
C — Notice is no substitute for stopping.
D — The passage sets no waiting period.

ℹ️ A wrinkle in CLAT 2025

The 2025 passage said sensitive data needs extra safeguards, and the key to Q83 follows it. The final Act has no separate 'sensitive data' category; children's data gets the extra care. In the exam, the passage wins.

💥 Myth vs fact

Myth or fact?

🙅 Myth

The Constitution expressly guarantees privacy.

Tap to bust it →

✅ Fact

The word never appears. Courts read it into life and personal liberty.

🙅 Myth

After Puttaswamy, privacy beats everything.

Tap to bust it →

✅ Fact

It's not absolute: law, legitimate aim and proportionality make an intrusion valid.

🙅 Myth

Puttaswamy struck down Aadhaar.

Tap to bust it →

✅ Fact

2017 only declared the right. In 2018 Aadhaar was largely upheld.

🙅 Myth

If an app leaks my data, I file an Article 21 writ against it.

Tap to bust it →

✅ Fact

Rights mainly bind the State. Against a company, use the data protection law or tort.

🎯 Quick quiz

Five fact patterns

0 / 5

Rule: the State may intrude on privacy only under a law, for a legitimate aim, by proportionate means. A police circular orders cab apps to share every rider's live location, to cut crime.

Q1. Is the circular valid?

Same rule. A statute lets a government university demand every student's psychiatric history before issuing a library card, 'for safety'.

Q2. The strongest objection?

Rule: consent must be specific and given by a clear affirmative action. Meher, 19, installs an app with a pre-ticked box: 'Your data may be used for any purpose.'

Q3. Valid consent?

Rule: consent may be withdrawn anytime; withdrawal doesn't affect earlier processing. Rohan let a fitness app share his steps with an insurer in January. He withdraws in March.

Q4. Which is correct?

Rule: private life can't be published without consent, but public records can, except that a sexual-offence victim must not be named. A site publishes (i) a fraudster's life story from his trial record, (ii) a victim's name from a trial record.

Q5. Which is lawful?

🎯 In a nutshell

Privacy is a fundamental right: body, information, choices.
Not absolute: law + legitimate aim + proportionality. Check legality first.
Aadhaar: welfare and PAN upheld; private use, bank and SIM linking struck down.
Against companies: specific consent or a legitimate use, plus rights to know, correct, erase, withdraw.
Exemptions cover only their stated purpose.

📎 Good to know, not to memorise

Puttaswamy (2017) 10 SCC 1, nine judges, 24 Aug 2017; Puttaswamy (Aadhaar) (2019) 1 SCC 1, 26 Sept 2018, 4:1.
Kharak Singh (1962, 4:2); Gobind (1975); R. Rajagopal (1994); Selvi (2010).
Aadhaar Act 2016: s.7 welfare, s.57 private use (struck down in part); PAN linking: s.139AA Income Tax Act.
DPDP Act 2023: s.6 consent, s.7 legitimate uses, s.9 children, ss.11–14 rights, s.17 exemptions; penalties up to ₹250 crore. Rules notified 2025.

Ready for a full passage?

Timed drills built like the CLAT 2024 and 2025 data protection sets.

Start the drill

Frequently asked questions

Is the right to privacy a fundamental right in India?

Yes. In Puttaswamy (2017), nine judges unanimously held that privacy is an intrinsic part of the right to life and personal liberty and of the other Part III freedoms. The word isn't in the Constitution; the Court read it in and overruled older benches that had said otherwise.

What is the three-part test from Puttaswamy?

A State intrusion on privacy needs a law, a legitimate aim, and proportionate means. The Aadhaar case split proportionality into four checks: a proper goal, a rational link to it, no equally effective but gentler alternative, and a fair balance between the gain and the harm.

Is Aadhaar mandatory after the Supreme Court judgment?

For welfare subsidies paid from public funds and for linking PAN, yes. The Court barred making it compulsory for bank accounts, SIM cards, school admissions and exams like NEET and JEE, and struck down private companies' use under the Act. A 2019 amendment later allowed voluntary bank and SIM use.

Does the DPDP Act treat sensitive data differently?

No separate 'sensitive personal data' category exists in the final Act; all digital personal data gets the same core protection, with extra rules for children. Older drafts had one, and the CLAT 2025 passage described extra safeguards for sensitive data. In the exam, apply whatever the passage says.

Can I enforce privacy against a private company?

Usually not through a writ, since fundamental rights mainly bind the State. Use the data protection law instead: complain to the company's grievance officer, then to the Data Protection Board. You may also sue in tort, for example for breach of confidence.