Data Protection Bill(s): Why Has India Failed to Legislate Privacy So Far?

The Indian experience in the direction of an inclusive data protection regime has been characterized by a series of legislative stalling, watering down of protection mechanisms, and political vagaries. In spite of the acknowledgement in the Article 21 of the Constitution that privacy is one of the fundamental rights, and therefore the Supreme Court in the case Justice K.S. Puttaswamy (Retd.) recognized this during its ruling. India is still grappling with the challenge of developing a strong and rights-based data protection framework. This paper will follow the development of data protection in India, dating back to the draft of the Justice B.N. Srikrishna Committee published in 2018 to the Digital Personal Data Protection Act, 2023, and the follow-up Draft Digital Personal Data Protection Rules, 2025. It argues that the absence of an independent regulatory body, large exemptions by states, watered-down consent processes, and lax protection against surveillance have rendered the existing framework unsuitable in terms of ensuring the protection of core rights. The paper ends by suggesting structural and policy changes that need to be made to balance the digital governance plans in India with the constitutional guarantee of privacy.