Section 36 of the Digital Personal Data Protection Act,2023

**Anmol Lall

Introduction

The enactment of the Digital Personal Data Protection Act,2023 must be understood as a consequence of the Supreme Court’s landmark decision in Justice K.S. Puttaswamy V. Union of India. The recognition of the right to privacy as a fundamental right under Article 21 of the Constitution of India affirmed that privacy is an essential facet of personal liberty and autonomy. The Court further clarified that any state action seeking to restrict this right must satisfy a rigorous four-pronged test comprising legality, the pursuit of a legitimate state aim, proportionality and adequate procedural safeguards.

The Digital Personal Data Protection Act,2023 was envisioned as the parliamentary response to give legislative effect to the Puttaswamy mandate. However, within the architecture of this statute lies a provision that threatens to undermine its objective intent. Section 36 of the Act empowers the Central Government to require the Data Protection Board, any data fiduciary, or any intermediary to furnish “any such information” as it may call for, provided that the request is made “for the purposes of this Act”. The Digital Personal Data Protection Rules,2025 further operationalize this provision. Rule 23, read with the seventh schedule of the Rules, operationalizes  Section 36 of the Act by specifying the purposes for which the Central Government may call for information, including the use of personal data in “interest of sovereignty and integrity of India or security of the State”.

In February 2026, the Supreme Court of India issued notice to the Central Government on a batch of petitions challenging the constitutional validity of Section 36, read alongside Rule 23 of the Digital Personal Data Protection Rules,2025. However, while the court refused to stay the operation of these provisions, it observed that “some ironing out of the creases might be needed to strike a balance”.

1. Legality as a constraint: Excessive Delegation and Privacy Infringement under Section 36 of the DPDP Act.

Whether a valid “law” restricting the right to privacy exists in the first place. The first prong of the Puttaswamy test requires that any restriction on privacy to be grounded in a law that is clear, precise, and accessible. However, this requirement extends beyond mere protection against vagueness; rather, it stems from the constitutional prohibition against excessive delegation of legislative power. The Supreme Court, in Re: Delhi Laws Act,  validated delegated legislation while strictly limiting its scope to ancillary and subsidiary actions of the executive. Further, the court emphasized that Essential Legislative Functions could not be delegated or abdicated. The Legislature is required to formulate legislative policy and prescribe guiding principles that ensure checks in the exercise of delegated authority. Consequently, where the parent act does not clarify the substantial framework and delegates the essential functions, the resulting delegated legislation exceeds the constitutional limits.

Section 36 of the Digital Personal Data Protection Act,2023 is emblematic of such an approach. It authorizes the Central Government to demand any information from any Data fiduciary or intermediary, provided the demand is made “for the purpose of this Act”. However, the Act itself does not define these “purposes”. It omits the circumstances under which the power may be exercised, the safeguards that must accompany its exercise, or even the kind of information that may be sought. Instead, all of these essential matters are delegated to the executive. Rule states that the government may call for the information “for such purposes of the act as are specified in the Seventh Schedule.” The Seventh Schedule then lists three specific purposes: 1) the sovereignty and security of the state,2) the performance of any function under any law, and 3) the assessment for notifying the significant data fiduciaries. 

In Hamdard Dawakhana v. Union of India,, the Court struck down a delegation that was “too vague and gave excessive power to the executive without clear guidelines”, holding that such delegation suffers from the vice of excessive delegation where the legislature fails to lay down either a clear legislative policy or adequate guiding principles. Since Section 36 delegates to the executive the power to define the substantive purposes and procedures for authorizing intrusions into privacy without any legislative guidance or policy, it effectively permits the executive to determine the bounds of its own authority.

2. From Regulation to Overreach: Questioning the legitimacy of the intent stated in the Seventh Schedule 

The second prong of the Puttaswamy proportionality test requires that any restriction on the right to privacy must pursue a legitimate state aim i.e., a specific and identifiable public interest sufficiently compelling to justify the restriction of a fundamental right. The Supreme Court has further held that the pursuit of a legitimate aim ensures that a law does not suffer from manifest arbitrariness, and that the state must demonstrate a genuine, substantive interest rather than merely advancing a formal justification. The Seventh Schedule of the Digital Personal Data Protection Rules 2025, lists three purposes for which the government may demand information under Section 36 of the Digital Personal Data Protection Act,2023.

The first purpose, namely, the protection of the “sovereignty and integrity of India or security of the State” is facially legitimate. The Puttaswamy Judgment itself acknowledged that the collection and storage of personal data in national interest is a legitimate interest. Furthermore, the third purpose under Section 36 of the Digital Personal Data Protection Act,2023, does enable the assessment for the notification of a Significant Data Fiduciaries, which serves as a valid objective and also bears a rational correlation with the statutory framework.

However, the statutory conflict arises from the second purpose. It empowers the Central Government to gather personal data for the “performance of any function under any law for the time being in force in India” or for the “disclosure of any information for fulfilling any obligation under any law for the time being in force in India.” However, the problem with these provisions is the broad language and vagueness in the section that enables the government to encompass, ranging from severe national security issues to regular administrative functions.  Furthermore, this Framework strengthens the State instrumentalities by effectively issuing a gag order, thereby removing protection obligations such as consent, notice and purpose limitation. This directly conflicts with the Article 19(1)a of the Indian Constitution, where extensive State access to personal data may create a negative impact on the freedom of speech and expression.  Article 19(2),however permits restriction on specific grounds such as sovereignty, security of the state, public order and friendly relations with foreign states. However, Article 19(2) of the Indian Constitution does not serve as a justification for the broad reference to the governmental function. The state must establish a proximate connection between the processing and the permitted grounds.

A legitimate aim must be one that reflects a genuine State interest and is sufficiently important to warrant the infringement of a fundamental right. The second purpose in the Seventh Schedule raises the concern that the State relies merely on the existence of a governmental function rather than demonstrating its connection to the constitutionally recognised Article 19(2) of the Indian Constitution. The State is fundamentally involved in everyday activities by its very existence and this risks permitting restrictions on speech beyond the limited grounds expressly contemplated under Article 19(2) of the Indian Constitution.

3.Procedural Vacuum and Constitutional Excess: Assessing Section 36 of the Digital Personal Data Protection Act,2023 through the Least Restrictive Means Standard.

The third prong of the Puttaswamy test requires that any restriction on privacy must constitute the least restrictive means available to achieve a legitimate State aim.

For instance, Section 69A of the Information Technology Act,2000 empowers the state to block online content on grounds of national security, sovereignty and public order, which are comparable to the objectives invoked under the Seventh Schedule. However, Section 69A of the Information Technology Act,2000 is accompanied by several procedural safeguards under the Information Technology (Procedure and Safeguards for Blocking Access for access of Information by Public) Rules,2009 including a reasoned order, examination by a designated committee, and a review by a review committee, with a special emergency procedure for urgent cases. In Shreya Singhal V. Union of India, the Supreme Court struck down Section 66A of the Information Technology Act,2000 as unconstitutional, while upholding Section 69A because the latter was narrowly tailored and embedded with procedural checks. In contrast, Section 36 requires none of these. The disparity is striking. However, Section 69A is not the only statutory framework that incorporates such procedural protections. Section empowers a court to order production of documents or information. Crucially, this provision requires a Judicial magistrate to apply his/her mind and determine that the information is necessary for an investigation, inquiry or other Judicial proceedings. Accordingly, this mechanism ensures judicial oversight, a written order and an opportunity for the affected party to challenge the demand. Section 36 of the Act bypasses the judicial oversight entirely.

Furthermore, even assuming that the Government prefers an executive led mechanism, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, demonstrate that less intrusive alternatives already exist within the existing legal framework. These rules as amended in 2025 govern the issue of content takedown directions to intermediaries and require senior level authorization, reasoned intimation with specific details and periodic review mechanism. Importantly, unlike Rule 23 of Digital Personal Data Protection Rules 2025, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 do not prohibit intermediaries from publishing takedown orders or notifying affected parties. The existence of this alternative statutory mechanism demonstrates that the objective sought to be achieved under Section 36 can be realized though measures that are accompanied by substantially stronger procedural safeguards.

The fundamental problem with Section 36 of the Digital Personal Data Protection Act,2023 and Rule 23(2) of the Digital Personal Data Protection Rules 2025 lies in the complete absence of procedural safeguards. There is no written order, no judicial scrutiny, no notice, no opportunity of being heard, and no prescribed retention limit exist. Moreover, the gag order under Rule 23(2) of the Digital Personal Data Protection Rules 2025 actively prevents the data fiduciary from notifying the affected individual, thereby eliminating the possibility of any meaningful post-facto challenge. Given that less restrictive yet equally effective mechanisms already operate under other legislations, such as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021,the Information Technology Act 2000 and Bharatiya Nagarik Surakhsha  Sanhita,2023 the Government cannot justify the sweeping and safeguard-free power conferred under Section 36.The Supreme Court in Anuradha Bhasin V. Union of India held that any restriction on fundamental rights must be proportionate, reasonable and least restrictive alternative.

4.Disproportionate without remedy: Section 36 of the Digital Personal Data Protection Act and the breakdown of Constitutional Balancing

The fourth prong of the Puttaswamy test is that it requires a fair balancing between the degree of harm inflicted on individual rights and the overall benefit to the State.

Ubi Jus Ibi remedium provides that when there is a right, there is a remedy. However, the statute goes against the principle by not providing for the right to appeal. This results in a concentration of powers towards the executive due to absence of a system of checks and balances. The Right to appeal has not been given to the Data fiduciary as well as the affected individual whose data has been requisitioned. It is because there is a mention of a gag order also that would ensure that affected individual may never become aware of the demand. The absence of a specific appellate authority and the failure to provide a statutory remedy is not merely a technical omission. The Article 21 expressly provides that the “no personal shall be deprived of his life and personal liberty except according to procedure established by law”. The personal liberty and autonomy of a person therefore would require adequate safeguards and independent judicial review in situations where the State action seriously affects the fundamental rights. In Maneka Gandhi V. Union of India, the Supreme Court had held that fair procedure would also require safeguards against arbitrary state actions, including protections where rights are seriously affected.

India follows separation of power in a limited sense , but the framework has enabled the executive to be both the decision maker as well as the enforcer. The lack of Judicial oversight to the situations in which there is restriction on disclosures on the affected individual from challenging the demand, may weaken the transparency and accountability. Further, there is no mechanism to minimise the retention of data or limits on the data retention. This increases the degree of interference with individual rights that may not be proportional with the intent of the statute.

The state has failed to explain the intent behind having legislation on a subject that is already having multiple legislations. Currently, Section 69A of the Information Technology Act,2000, permits interception, monitoring or decryption subject to specified grounds; Section 94 of the Bharatiya Nagarik Suraksha Sanhita,2023 regulates the production of document or things. India’s legal system demonstrates that state access to information has already been structured through purpose specific powers and procedural safeguards. The Government must therefore explain the reason why these existing mechanisms are insufficient and why a framework with broader surveillance powers with minimal safeguards is necessary. The absence of such justification weakens the State’s argument at the balancing stage, particularly where there are mechanism that are less restrictive may be available.

Way Forward

Recently, the Section was challenged in the The Reporters Collective Trust v. Union of India where the Court issued a notice on the Constitutional Challenge. Court also observed that “some ironing out of the creases might be needed. The language employed by the court clearly indicates that incremental constitutional corrections and the curing of these defects remain open for judicial consideration.

Some remedies are well within the Court’s power and readily implementable without rewriting the statute. First, the Court can mandate that all demands under Section 36 of the Digital Personal Data Protection Act,2003 be subject to review by a Judicial Magistrate akin to the mechanism envisaged under Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023. Second, the second purpose in the Seventh Schedule, namely, “performance of any function under any law” constitutes the primary source of the provision’s overbreadth. The Court may therefore strike down this ground as void for vagueness while preserving the remaining two purposes. Third, the gag order may be limited. Rule 23(2) of the Digital Personal Data Protection Rules 2025 can be read down to require post-facto notification to the affected individual within a fixed period following the disclosure, with any extension requiring the prior approval of a Judicial Magistrate. Together, these remedies would preserve the legitimate objectives of the Act while ensuring its conformity with the constitutional guarantees recognized in Puttaswamy. They would not require legislative intervention by Parliament rather, they fall squarely within the Court’s constitutional role of ensuring that statutory limitations remain proportionate and consistent with Article 21.

**Anmol Lall is a BA LLB (Hons) student at GNLU. 

**Disclaimer: The views expressed in this blog do not necessarily align with the views of the Vidhi Centre for Legal Policy.