Author: Aneesha Jha, Banaras Hindu University

The accelerated growth of Artificial Intelligence (AI) across all kinds of sectors like healthcare, finance and governance has birthed a new era of convenience, efficiency and capability but everything that is boon does contain some element of challenges and in this case it is our most fundamental right: Right to Privacy. In India over 900 million people use the Internet to generate volumes of daily data. So, when Privacy is considered a moral value, it has also evolved into a constitutionally protected legal right in the landmark case of K.S Puttaswamy v. Union of India where the Supreme Court declared privacy a Fundamental Right under Article 21. 

Artificial Intelligence is a technology that enables machines as well as computers to imitate human learning, problem- solving, decision- making, creativity and comprehension. It can identify and see things that help us understand and gain knowledge of various sectors. 

This article raises an important constitutional question: how do we protect our privacy while taking advantage of this new innovation?

It discusses the conflict under the Indian legal system and contends that while India has made some significant legislative moves, it is clear that there are stronger, rights, oriented safeguards to be adapted.

The ruling in the Puttaswamy case also overruled the cases of M. P. Sharma and Kharak Singh, wherein the Courts held that the right to privacy is not a fundamental right. In the subsequently rendered judgment, Puttaswamy (2018), the Supreme Court held that the right to privacy is comprised of three principles: 

(1) Legality, meaning an individual is entitled to privacy if there is adequate statutory authority to cease its effect; 

(2) Necessity, meaning the nature of the restriction must be for a pressing and legitimate reason; 

(3) Proportionality, meaning that the restriction must be minimal in nature and therefore use an excessive means of governmental interference. 

How AI Threatens Privacy

AI systems are zealous consumers of personal data and are increasingly allocated in several high-risk domains. Our government and law enforcement agencies have adopted a number of new technologies relating to AI in various sectors. Some of these are- 

• The police have also been using the facial recognition system (AFRS) which they had been given for one specific purpose, but the use has reportedly gone beyond the initial purpose as the system was also used to identify persons participating in different protests including the protests against CAA in 2020. This, in turn, resulted in the limitation of freedom of speech and peaceful assembly as stipulated under Article 19 while at the same time the right to life and personal liberty guaranteed under Article 21 has been violated.

• There are numerous instances when large amounts of private data have been collected by the companies through different means such as mobile applications, e, commerce platforms, health trackers, etc. most of the time even the consumers are not aware and have not given their consent.

• Generative AI such as ChatGPT or Google Gemini require learning from the massive datasets in order to produce the outputs they generate. Although they are very useful and efficient tools, the way they work is completely hidden and thus they raise issues of collecting too much the data, their storage for an indefinite period of time, and last but not least the use of the data for other purposes than those for which it was collected.

• Section 17 allows the government to exempt itself from several provisions on grounds of national security or public order. Such a broad exemption is likely to pave the way for unlimited surveillance, thus, repeating the pattern of criticism which the Aadhaar framework faced previously.

India's landmark legal initiative on data protection is undoubtedly the Digital Personal Data Protection Act, 2023 (DPDPA), which, after rules being notified in November 2025, is now fully functional.

The legislation introduces several ground, breaking elements, Individuals are identified as data principals, businesses and other organisations dealing with data are data fiduciaries. It requires:

Informed consent, data minimisation, purpose limitation, and rights such as the correction and erasure of personal data. Notably, the Act covers AI systems hence, large tech firms are compelled to avoid excessive data usage and offer opt out options. It further institutes the Data Protection Board of India (DPB) to ensure compliance and impose penalties for infringements.

Courts have expressed this concern when it comes to decisions regarding hiring or scoring credits through algorithms and stressed the need to be open and fair. The following are not specifically mentioned in DPDPA as areas to be concerned about:

• Algorithmic bias

• Automated decision-making

• The right to explanation

The specific provisions that would protect the public from bias and transparency in AI systems are not available under Indian law, which is different from the EU’s GDPR.

Various Challenges and the importance of Reform

Various challenges are:

• Dependence on foreign hardware and cloud services

• Data transfer from one country to another

• The biased nature of AI systems affecting marginalized groups

• The leniency of governments and their authorities. 

Reforms that are essential to solving the problems:

• Devoted AI Law India should adopt a comprehensive AI law that ensures privacy, accountability, transparency, by design, and periodic audits.

• Stronger Regulatory Oversight: The independence of the UK's Information Commissioner could be encouraged across the world with the Data Protection Board being vested with the needed authority.

• Ethical AI Development: The enhancement of technologies such as anonymization and differential privacy needs to be made mandatory.

• Greater Citizen Remedies – Civil Society Should Have the Right to Collective Statutes Such as Class Action Securities of Violations of Substantive Privacy Rights.

There is no doubt that the AI has the potential to contribute to any country’s growth in a wide range of industries such as healthcare, education, and agriculture. However, the development of technology should never be at the expense of overriding core values of the constitution. In the Puttaswamy case, the Supreme Court ruled that privacy is very closely linked to human dignity and freedom. The Digital Personal Data Protection Act could be a step in the right direction but it is not sufficient on its own. As AI continues to evolve at a breakneck speed, the Indian government should not only prepare its policies to be compatible with the technology but also keep at the centre of governance the people rather than algorithms.

At this critical juncture, India has an opportunity to lead by example and create a legal environment that is not only conducive to innovation but also respects freedom and where AI is a means of strengthening democracy, not undermining it.

1. AI Applications and Models Now Protected Under India’s New Data Privacy Law: Ashwini Vaishnaw, The Economic Times (Nov. 2025), https://legal.economictimes.indiatimes.com/news/web-stories/ai-applications-and-models-now-protected-under-indias-new-data-privacy-law-ashwini-vaishnaw/125740042.

2.   Artificial Intelligence and the Right to Privacy: A Constitutional Challenge for India, Indian Journal of Law & Legal Research, https://www.ijllr.com/post/artificial-intelligence-and-the-right-to-privacy-a-constitutional-challenge-for-india.

3.  DPDP Law Takes Effect as India Tightens AI-Era Data Protections, Digital Watch Observatory, https://dig.watch/updates/dpdp-law-takes-effect-as-india-tightens-ai-era-data-protections.

4.  Privacy Standards in Artificial Intelligence, IndiaAI, https://indiaai.gov.in/ai-standards/privacy.

5.  India Unveils Techno-Legal Framework to Embed Governance into AI Systems by Design, BABL AI, https://babl.ai/india-unveils-techno-legal-framework-to-embed-governance-into-ai-systems-by-design/.

6.  AI and Data Protection: Are We Truly Protected by Our Data Shield?, Indian Institute of Public Policy Research, https://iisppr.org.in/ai-and-data-protection-we-truly-protected-by-our-data-shield/.

7. AI and Data Privacy in India, Cyber Law Consulting, https://www.cyberlawconsulting.com/ai_and_data_privacy_in_India.php.

8. AI Surveillance and Privacy in India: Human Rights in the Age of Technology, Oxford Human Rights Hub, https://ohrh.law.ox.ac.uk/ai-surveillance-and-privacy-in-india-human-rights-in-the-age-of-technology/.