India's Digital Personal Data Protection Act 2023 faces constitutional scrutiny. Critics argue that while the Act mandates user consent, broad executive exemption clauses allow government surveillance bypassing judicial oversight. This conflicts with the Puttaswamy ruling, which declared privacy a fundamental right under Article 21 and required any limitation to satisfy proportionality, legality, necessity, and procedural guarantee tests. The Act's Section 17 exemptions for state agencies remain the central constitutional flashpoint in current academic and judicial discourse.

The constitutional critique of the DPDP Act 2023 is rooted in the nine-judge bench ruling in K.S. Puttaswamy v. Union of India (2017), which unanimously held that the right to privacy is a fundamental right under Article 21, read with Articles 14 and 19. The Court laid down a four-part proportionality test for any legitimate restriction: (1) existence of a law, (2) legitimate state aim, (3) proportionality between means and ends, and (4) procedural guarantees against abuse.

The DPDP Act 2023, enacted under Article 246 read with Entry 97 of the Union List, creates a consent-based framework for data processing. However, Section 17 grants the Central Government sweeping exemption powers — allowing it to exempt any government instrumentality from all or any provisions of the Act by notification. Critics argue this creates a structural asymmetry: citizens must comply strictly, while the state apparatus faces no equivalent restraint.

The constitutional problem is threefold. First, the exemptions are executive-driven, not parliamentary, violating the Puttaswamy requirement that restrictions be grounded in law with adequate standards. Second, the absence of an independent judicial oversight mechanism for state surveillance fails the procedural guarantee prong. Third, the broad exemption language arguably fails the proportionality and necessity tests since it allows blanket rather than targeted restriction.

This critique connects directly to Article 14 (arbitrariness doctrine post-Maneka Gandhi), Article 19(1)(a) (informational self-determination as speech), and Article 300A (property in personal data). For CLAT PG, the examiner will test whether aspirants can apply the Puttaswamy proportionality test to novel surveillance scenarios — the core skill being tested here.