Artificial Intelligence (AI) is increasingly influencing how people communicate, work, access services and make everyday decisions. AI systems can process enormous quantities of information, identify patterns and generate predictions. These capabilities offer significant benefits in areas such as healthcare, education, administration and public services. However, they also create concerns about the collection, use and misuse of personal information.
In a digital environment, personal data may be collected through mobile applications, social media platforms, online transactions, surveillance systems and other digital services. Individuals may not always know what information is being collected, how it is analysed or whether it is being shared with third parties. AI makes these concerns more serious because information collected for one purpose may later be analysed or used for another.
The recognition of privacy as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) marked an important development in Indian constitutional law. This article examines the constitutional foundation of privacy, the challenges created by AI and the extent to which India’s data protection framework addresses those challenges.
How Indian Courts Developed the Right to Privacy
The Constitution of India does not expressly use the term “right to privacy”. Nevertheless, the Supreme Court has developed constitutional protection for privacy through its interpretation of fundamental rights, particularly Article 21.
In M.P. Sharma v. Satish Chandra (1954), the Supreme Court considered whether protection against unreasonable searches and seizures could be derived from the constitutional provisions then under consideration. The Court did not recognise a general fundamental right to privacy in that case.
In Kharak Singh v. State of Uttar Pradesh (1962), the Court examined police surveillance practices. Although the majority did not recognise a general constitutional right to privacy, it invalidated domiciliary visits under the police regulations as an infringement of personal liberty. Justice Subba Rao’s dissent offered a broader understanding of privacy.
The legal position changed significantly in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). A nine-judge Constitution Bench unanimously recognised privacy as a fundamental right protected by the Constitution. The Court explained that privacy is closely connected with dignity, individual autonomy, personal liberty and the freedom to make decisions about one’s life.
The judgment also recognised informational privacy, which concerns an individual’s ability to exercise control over personal information. This principle has particular importance in the age of AI. Personal information is not merely a collection of facts; its analysis can reveal a person’s habits, relationships, preferences and behaviour. Nowadays, data has become a valuable resource. With access to data, countless possibilities emerge, and it can be used to create, develop and influence almost every aspect of modern life.
The judgment clarified that privacy is not absolute. Any restriction must satisfy constitutional requirements, including legality, a legitimate state objective and proportionality. These principles provide an important standard for evaluating surveillance and data-processing practices.
Aadhaar and the Limits of Personal Data Collection
The relationship between privacy and digital identity systems was further examined in K.S. Puttaswamy (Aadhaar) v. Union of India (2018). The Supreme Court considered the constitutional validity of the Aadhaar framework and the use of biometric and demographic information.
The Aadhaar judgment opens with the observation: “It is better to be unique than the best. Because, being the best makes you the number one, but being unique makes you the only one.” This observation introduces the idea of unique identification, which is central to the Aadhaar system.
The primary objective of introducing Aadhaar was to improve the delivery of subsidies, benefits and public services, particularly welfare schemes and the Public Distribution System. The Unique Identification Authority of India (UIDAI) was initially established in January 2009 as an attached office of the Planning Commission. The first Aadhaar number was issued on 29 September 2010. Later, UIDAI became a statutory authority under the Aadhaar Act, 2016, on 12 July 2016.
The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 was enacted to provide a legal framework for the delivery of subsidies, benefits and services through unique identification numbers. The Act received presidential assent on 25 March 2016. Its provisions subsequently came into force through government notifications.
Under the Aadhaar system, individuals provide demographic and biometric information during enrolment. Demographic information includes details such as name, date of birth and address, while biometric information includes photographs, fingerprints and iris scans. This information is collected through authorised enrolment agencies and processed by UIDAI for the purpose of issuing unique identification numbers and carrying out authentication.
Over time, Aadhaar was also linked with various government schemes and other services. Section 7 of the Act provides for the use of Aadhaar for establishing identity in connection with certain subsidies, benefits and services funded from the Consolidated Fund of India. However, the expansion of Aadhaar’s use raised concerns about the collection, storage and protection of personal information.
The central privacy concern was whether the collection and storage of such large amounts of personal data could create possibilities of data leakage, unauthorised access and misuse. Such risks raised questions about the protection of individual privacy, dignity and personal autonomy. The government maintained that appropriate security safeguards had been established to protect the information collected through the Aadhaar system. The constitutional debate also involved the question of whether privacy was protected as a fundamental right. This question had already been addressed by the nine-judge Constitution Bench in the 2017 Puttaswamy judgment, which recognised privacy as a fundamental right.
In its 2018 decision, the Supreme Court upheld the constitutional validity of the Aadhaar Act, 2016, subject to certain limitations. It upheld Section 7, which permits Aadhaar-based identification for specified subsidies, benefits and services. However, the Court struck down Section 57 to the extent that it allowed private entities to use Aadhaar authentication merely on the basis of a contract. It also invalidated mandatory linking of Aadhaar with bank accounts under the then-existing provisions and mandatory linking of mobile connections under the telecom circulars.
The subsequent Aadhaar and Other Laws (Amendment) Act, 2019 amended the legal framework governing Aadhaar use, including provisions concerning voluntary use and authentication. Therefore, it would be inaccurate to describe all Aadhaar linking as completely voluntary in every context. The applicable requirements depend on the relevant law and service-specific provisions.
The decision demonstrated the need to balance the government’s interest in delivering welfare benefits and preventing misuse with the individual’s right to privacy. The Court did not declare the entire Aadhaar system unconstitutional; instead, it upheld the framework while imposing constitutional limitations on certain uses.
The broader constitutional lesson is that technological convenience or administrative efficiency cannot, by themselves, justify unrestricted collection and use of personal information. Systems involving sensitive personal data require appropriate legal safeguards, a legitimate purpose and measures proportionate to that purpose.
This principle remains relevant when governments and private organisations adopt AI-based identification, verification and decision-making systems. If data breaches or unlawful errors occur, they may create serious trust issues and undermine public confidence in the authority’s credibility and integrity.
Privacy Challenges Created by Artificial Intelligence
AI creates privacy risks not only because of the amount of data it processes but also because of the conclusions that can be drawn from that data.
Collection and Reuse of Personal Information
AI systems often depend on large datasets for training, testing and operation. Information available on websites and social media may be collected and processed on a large scale. However, the fact that information can be accessed online does not automatically mean that every subsequent use is fair, expected or lawful.
In the age of AI, individuals must remain increasingly cautious about their digital presence. As personal information becomes more accessible and easier to process, maintaining privacy and security becomes increasingly challenging. In such circumstances, privacy may sometimes appear to be more of an ideal than a reality.
The dispute in Meta Platforms, Inc. v. Bright Data Ltd. (2024) illustrates some of the legal and commercial complexities surrounding the collection of publicly accessible online information. However, this US decision concerned particular contractual and related legal claims. It should not be treated as establishing a general permission to collect personal data for any commercial or AI-related purpose.
Facial Recognition and Surveillance
Facial recognition technology can identify individuals from photographs and video recordings. Although it may assist security and law-enforcement activities, its use can also enable continuous tracking and monitoring. When such systems operate without adequate safeguards, individuals may lose practical control over their movements and personal activities.
Algorithmic Profiling and Discrimination
AI systems can analyse personal information to predict behaviour, assess risk or classify individuals. These predictions may influence decisions relating to employment, credit, insurance and access to public services. If the underlying data is incomplete or biased, the resulting decisions may unfairly disadvantage certain individuals.
The concern is not limited to whether personal information is disclosed. It also concerns how information is interpreted and used to make decisions that affect people’s lives.
Deepfakes and Misuse of Identity
AI-generated images, audio and videos can imitate a person’s appearance or voice. Such material may be used to mislead the public, damage reputations or facilitate harassment. Indian courts have increasingly addressed personality and publicity rights in disputes involving the unauthorised commercial use of individuals’ identities. The decision in Anil Kapoor v. Simply Life India (2023) is one example of judicial attention to such concerns. The Delhi High Court addressed the unauthorised use of the actor’s name, image, voice and other personality attributes, including misuse through AI-generated content.
Cybercrime and Online Harassment
Digital technology can also facilitate impersonation, identity theft, cyberstalking and the circulation of manipulated content. The prosecution in State of Tamil Nadu v. Suhas Katti (2004) is an early example of judicial engagement with online harassment. Although it was not an AI-related case, it demonstrates that misuse of digital platforms can cause serious harm to personal dignity and safety.
These challenges show that privacy protection must address not only unauthorised access to information but also its collection, analysis, reuse and consequences.
India’s Data Protection and AI Governance Framework
The Digital Personal Data Protection Act, 2023 (DPDP Act) is an important step towards regulating the processing of digital personal data in India. It establishes obligations for Data Fiduciaries and provides rights to Data Principals, subject to the Act’s provisions and applicable exemptions.
The Act seeks to regulate the processing of digital personal data and establishes requirements concerning consent, certain legitimate uses, security safeguards and individual rights. These provisions are relevant to organisations that use personal information in AI systems.
However, one provision requires particular attention. Section 3(c)(ii) excludes certain personal data made or caused to be made publicly available by the Data Principal, or by another person who is legally required to make it publicly available. This raises an important question in the AI context: when personal information is publicly accessible, to what extent should its collection, combination and further use be regulated? Public accessibility should not be confused with unrestricted permission for every possible downstream use. The scope and application of this exclusion require careful interpretation.
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Their commencement is phased, and the Act and Rules have separate commencement notifications.
Under the Act’s commencement notification, G.S.R. 843(E), dated 13 November 2025, the first set of provisions came into force on the date of publication. These include Section 2 and certain institutional and preliminary provisions. The next stage, covering Section 6(9) and Section 27(1)(d), is scheduled to commence on 13 November 2026. The majority of the substantive provisions, including Sections 3 to 5, Sections 6 to 17 and other specified provisions, are scheduled to commence on 13 May 2027.
The Rules also follow a phased timeline under G.S.R. 846(E), dated 13 November 2025. Rules 1, 2 and 17 to 21 came into force upon publication. Rule 4 is scheduled to commence on 13 November 2026, while Rules 3, 5 to 16, 22 and 23 are scheduled to commence on 13 May 2027. Therefore, it would be inaccurate to suggest that every requirement of the Act and Rules became operational immediately upon notification.
India has also issued the India AI Governance Guidelines (2025), which address responsible AI development and deployment. These guidelines contribute to the policy discussion on safety, accountability and responsible innovation.
The Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 also remain relevant to aspects of digital regulation and intermediary responsibilities.
Although these measures provide a developing regulatory framework, effective protection depends on implementation, institutional capacity, transparency and accessible remedies.
The Challenges of Making Privacy Protection Effective
The recognition of privacy as a fundamental right was a significant constitutional achievement. However, the rapid development of AI raises questions that constitutional recognition alone cannot resolve.
One major concern is the gap between formal consent and meaningful understanding. Individuals may accept lengthy privacy policies without knowing how their information will be analysed or combined with other datasets. Consent may therefore become a procedural formality rather than a genuine exercise of choice.
Another concern is accountability. When an AI system produces an inaccurate or discriminatory result, it may be difficult for an affected individual to identify the responsible organisation or understand the reasoning behind the decision. Effective privacy protection should therefore include transparency, appropriate human oversight and meaningful mechanisms for challenging harmful decisions.
The treatment of publicly available information also deserves careful attention. Information shared for one purpose may be collected and analysed for a completely different purpose. The ability to access information should not automatically remove the need to consider individual autonomy, fairness and the consequences of its reuse.
A balanced framework must protect individuals without unnecessarily preventing technological progress. AI can contribute to public welfare, but innovation should operate within constitutional values. Legality, legitimate purpose, proportionality and accountability should guide both public and private uses of AI.
Protecting Privacy While Advancing Technology
The right to privacy has become increasingly important in a society where personal information supports digital services and AI-driven decisions. The Puttaswamy judgment established that privacy is an essential part of dignity, autonomy and personal liberty under the Indian Constitution.
The DPDP Act, 2023, the DPDP Rules, 2025 and India’s AI governance initiatives represent important developments. Nevertheless, the effectiveness of these measures will depend on their implementation and their ability to address emerging forms of data collection, profiling and surveillance.
Ultimately, the objective should not be to oppose technological development but to ensure that it respects individual rights. AI should serve people and society, not weaken personal autonomy. A rights-based approach to technology must recognise that privacy is not simply about keeping information secret; it is also about preserving an individual’s ability to exercise meaningful control over personal information and decisions affecting their life.
At the same time, we must learn to use technology positively and responsibly. We should maintain control over technology rather than allow technology to control us.
❤️ Support Independent Journalism
Your contribution keeps our reporting free, fearless, and accessible to everyone.
Or make a one-time donation
Secure via Razorpay • 12 monthly payments • Cancel anytime before next cycle
(We don’t allow anyone to copy content. For Copyright or Use of Content related questions, visit here.)
Aswani S. Babu is a law graduate from the University of Delhi with experience in legal research and litigation support across civil, criminal, family, labour and motor accident matters.
