Section 36 of the Digital Personal Data Protection Act, 2023 empowers the Central Government to exempt any data fiduciary, including state agencies, from the Act's provisions through executive notification. Enacted as a consequence of the Supreme Court's Puttaswamy judgment recognising privacy as a fundamental right under Article 21, the section has drawn criticism for allowing the executive to hollow out privacy protections without parliamentary oversight, raising constitutional questions about proportionality and the right to privacy itself.

The Digital Personal Data Protection Act, 2023 was Parliament's legislative response to K.S. Puttaswamy v. Union of India (2017), where a nine-judge bench unanimously held that privacy is a fundamental right under Article 21. The Puttaswamy court laid down that any restriction on privacy must satisfy a three-part test: legality (a law must exist), legitimate aim (a compelling state interest), and proportionality (the means must be necessary and narrowly tailored).

Section 36 of the DPDPA 2023 allows the Central Government to issue notifications exempting any data fiduciary from one or more provisions of the Act in the interest of sovereignty, security, or friendly relations with foreign states, or for maintaining public order. Critically, this power is exercised by executive notification, not by legislation, which raises the question: does an executive exemption satisfy the Puttaswamy proportionality test, which demands a 'law' and not merely an executive order?

The constitutional tension is sharp. Article 21 rights can be curtailed only by 'procedure established by law,' and post-Maneka Gandhi (1978), that procedure must be fair, just, and reasonable. An open-ended executive power to grant exemptions — without a sunset clause, parliamentary scrutiny, or judicial oversight — arguably fails the proportionality and necessity tests the Supreme Court itself demanded in Puttaswamy.

For CLAT PG, Section 36 sits at the intersection of three tested doctrines: the right to privacy under Article 21, the proportionality standard from Puttaswamy, and the constitutional validity of delegated legislation that curtails fundamental rights.