The enactment of the Digital Personal Data Protection Act (DPDPA), 2023, marked a paradigm shift in India’s legal landscape, establishing the country’s first comprehensive legislative framework for digital data governance.[Yadav, P. (2026). Privacy in the digital age: A critical study of the DPDP Act 2023 and its implications. Chinnu Ramaswamy College Law Research Journal.] Driven by the constitutional mandate of the Supreme Court’s historic ruling in Justice K. S. Puttaswamy (Retd.) v. Union of India (2017),[Justice K. S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors., (2017) 10 SCC 1. The nine-judge bench unanimously held that privacy is a fundamental right under Article 21 of the Constitution of India.] the Act was designed to safeguard informational privacy under Article 21 of the Indian Constitution.[Sethi, M. I. S. (2025). The Digital Personal Data Protection Act 2023: Implications for mental healthcare practice in India. PubMed Central, PMC12423081.] However, its ultimate legislative design introduces a stark constitutional paradox. While the DPDPA constructs a robust compliance architecture for private entities (“data fiduciaries”), it simultaneously carves out expansive, unchecked exemptions for State instrumentalities under the banner of national security, public order, and sovereign functions.[Saurabh, S. (2024). The Digital Personal Data Protection Act of 2023: Strengthening privacy in the digital age. International Journal of Law in Changing World, 3(2), 77–94. https://doi.org/10.54934/ijlcw.v3i2.84]

This research paper critically examines the intensifying friction between state surveillance practices and individual informational privacy in India under the DPDPA regime. By assessing structural mechanisms such as Section 7 (legitimate uses) and Section 18 (state exemptions), this paper explores how the Act dilutes core data protection principles—namely purpose limitation, data minimization, and independent oversight. It further contextualizes these legislative gaps against the backdrop of India’s expanding digital surveillance infrastructure, including the Central Monitoring System (CMS), Netra, and facial recognition technologies (FRTs). Ultimately, the paper argues that the DPDPA tilts the balance of power toward a state-centric model of control, failing the tripartite test of proportionality established in Puttaswamy. It concludes by outlining mandatory legislative, judicial, and systemic reforms necessary to reconcile sovereign security interests with the fundamental right to privacy in a digital democratic state.