Internet Freedom Foundation — India Personal Data Protection Bill campaign (2019–2023)

The Internet Freedom Foundation (IFF)'s campaign for a constitutionally grounded personal data protection law in India ran through four iterations of the legislation over four years — from the introduction of the Personal Data Protection Bill, 2019 to the enactment of the Digital Personal Data Protection Act, 2023 on August 11 of that year. Anchored in the Supreme Court's 2017 Puttaswamy ruling recognising informational privacy as a fundamental right, and channelled through the #SaveOurPrivacy coalition IFF powered, the campaign produced the principal public-facing civil society analysis at each legislative stage — JPC submissions, public briefs, clause-by-clause analyses, consultation responses, and parliamentary-stage statements — while pressing consistently for an independent Data Protection Board, removal of government surveillance exemptions, and accompanying surveillance reform legislation. The Act enacted in 2023 was characterised by IFF as "extremely disappointing" on all three fronts; a constitutional challenge IFF filed in 2025 opened a new legal accountability track on the same substantive arguments.

The #SaveOurPrivacy coalition and the Indian Privacy Code

The campaign's public-facing vehicle was #SaveOurPrivacy, a community project powered by IFF and launched in May 2018. The coalition published the Indian Privacy Code, 2018 — a model citizens' bill built around seven core principles covering consent, data minimisation, purpose limitation, individual rights, independent oversight, surveillance reform, and transparency — drafted by volunteer lawyers and policy analysts. The Indian Privacy Code was introduced as a private member's bill twice in Parliament, establishing a citizen-grounded legislative alternative to the government's own draft. The coalition's seven-principle framework functioned as the campaign's evaluation standard throughout the legislative cycle: where government drafts departed from a principle, IFF named the departure and documented its constitutional implications. Apar Gupta, IFF's co-founder and first executive director from 2018 to November 2023, was a co-founder of the SaveOurPrivacy campaign; IFF's annual public analysis releases were the coalition's principal technical outputs.

Engaging the Joint Parliamentary Committee (2019–2021)

The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha on December 11, 2019 and referred to a Joint Parliamentary Committee (JPC) chaired by Member of Parliament Meenakshi Lekhi. IFF's advocacy strategy across the JPC's two-year review operated on two tracks simultaneously: direct committee engagement through submissions and consultations (IFF made a formal representation to the JPC dated December 19, 2019), and public-facing engagement through clause-by-clause analysis accessible to non-specialist readers. IFF's public analysis identified the top ten issues with the 2019 bill, anchored in the Puttaswamy test of legality, necessity, and proportionality: the bill's sweeping government surveillance exemptions allowed state data processing free from the constitutional constraints the ruling imposed; no accompanying surveillance reform legislation addressed the broader interception architecture; the proposed Data Protection Authority was susceptible to executive influence; and data principals lacked meaningful rights of access, correction, and redress. IFF also wrote to the JPC urging it to bring a wider range of independent academics, civil society voices, and technical experts before the committee — the JPC's process was criticised throughout for insufficient openness to diverse inputs.

The JPC Report and Data Protection Bill, 2021

The JPC released its report and a revised text titled the Data Protection Bill, 2021 on December 16, 2021 — nearly two years and several extensions after the bill was referred. Eight JPC members filed dissent notes, signalling significant internal disagreement. IFF's public assessment was critical on structural grounds: the JPC proposed more than 80 changes to the text but retained the government surveillance exemptions IFF had flagged since 2019; the bill still contained no provisions for surveillance reform, which IFF argued the Puttaswamy ruling had placed on the constitutional agenda and the JPC had ignored entirely; and the Data Protection Authority remained susceptible to executive influence. IFF characterised the JPC's approach as one that prioritised the interests of large data processors and government instrumentalities over the constitutional framework the 2017 ruling had established.

The withdrawal and the 2022 draft consultation

On August 3, 2022, the government withdrew the Data Protection Bill, 2021 from Parliament, citing the scale of the JPC's changes — more than 80 recommended amendments — as justification for starting over. Civil society groups including IFF were critical of the withdrawal as squandering years of consultative investment without explaining what substantive correction it represented. The government released the draft Digital Personal Data Protection Bill, 2022 for public consultation on November 18, 2022. IFF's first read and subsequent formal consultation response identified the 2022 draft as in several respects weaker than its predecessors: Clause 18(2)(a) allowed the Union Government to exempt any "instrumentality" of the State from the Act's application in the interests of "sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence" — a broad exemption IFF argued preempted any judicial review of state data processing and thereby widened the surveillance-exemption architecture that had been the campaign's primary target since 2019. The proposed Data Protection Board lacked the independence needed to oversee government compliance. Notice requirements and data principal rights were reduced compared to the 2019 bill. IFF publicly documented ten key concerns during the consultation window.

The DPDP Act, 2023 and IFF's verdict

The Digital Personal Data Protection Bill, 2023 was introduced in the Lok Sabha on August 3, 2023 and passed on August 7 after 52 minutes of debate with 9 members speaking; it passed Rajya Sabha on August 9 after 67 minutes with 7 members speaking, and received Presidential assent on August 11. The brevity of parliamentary debate — 52 and 67 minutes respectively for a law affecting the informational privacy of over a billion people and concluding four years of consultative process — was noted by civil society as disproportionate. IFF's official statement characterised the Act as "extremely disappointing": government exemptions allowing state instrumentalities to be removed from the Act's provisions remained as broad as in successive drafts; the Data Protection Board was constituted as executive-controlled, without the independence IFF had argued was constitutionally required; an amendment to the Right to Information Act allowed personal information about public officials acting in official capacity to be withheld, weakening the RTI regime; and compliance obligations fell disproportionately on civil society and non-profits that process personal data in the course of public-interest work. The DPDP Rules, 2025, subsequently published, were assessed by IFF as failing to address the same structural concerns the consultation process had raised since 2022.

The constitutional challenge

IFF's campaign did not close with the Act's enactment. In 2025, IFF filed a constitutional challenge to the DPDP Act, 2023 and the DPDP Rules, 2025 in the Supreme Court of India; the Court issued notice on the petition, opening a judicial accountability track on the same substantive arguments the campaign had pressed through the legislative process. The petition continued IFF's Puttaswamy-grounded framework: the Act's government surveillance exemptions cannot survive the constitutional test of legality, necessity, and proportionality; and a data protection regime that removes the state from scrutiny while binding private actors produces, in practice, a law whose subjects are surveilled by the very authority nominally charged with protecting their informational privacy.

Significance

The campaign closes the corpus's India data-protection-legislation gap. IFF's existing corpus entries — Project Panoptic on facial recognition and the Aarogya Setu contact-tracing campaign — document the organisation's tool-specific advocacy work; the legislative campaign documented here is the structural parallel: IFF's sustained engagement with the law that would govern all data processing in India, including the AI and biometric surveillance systems those tool-specific campaigns contested. The campaign also extends the corpus's Global South legislative advocacy coverage beyond Africa and Latin America into South Asia, and provides a contrast case to the EDRi-coordinated EU AI Act coalition in the corpus — where the EDRi coalition ran a pan-European co-decision process and achieved partial legislative wins, the IFF campaign ran through a parliamentary process with curtailed civil society access and achieved few, demonstrating the structural dependence of legislative campaign outcomes on the procedural openness of the legislative body being targeted.