Republic Day Special: Digital Rights Every Indian Citizen Has

Alright, so every January 26th we talk about the Constitution, our freedoms, the sacrifices that built this republic. And that's good — those conversations matter. But here's something that often gets left out of the Republic Day speeches and school assemblies: your rights don't stop at the physical world. They follow you online. Into your WhatsApp chats, your Aadhaar-linked services, your social media posts, your browsing history. The Indian Constitution, backed by some genuinely bold Supreme Court rulings over the past decade, has something to say about all of it.

Most people don't know this. Not because the information is hidden, but because nobody really explains it in plain language. Legal judgments run hundreds of pages. Acts of Parliament use language that seems designed to be unreadable. So let's fix that, at least partially, by walking through the digital rights you actually have as an Indian citizen — and more importantly, how you can exercise them when someone violates those rights.

The Puttaswamy Judgment: Privacy as a Fundamental Right

The single most significant moment for digital rights in India happened on August 24, 2017, when a nine-judge bench of the Supreme Court delivered the Justice K.S. Puttaswamy (Retd.) vs Union of India verdict. The case itself started over Aadhaar — whether the government could mandate biometric identification for accessing services. But the judgment went much further than Aadhaar. A unanimous bench declared that the right to privacy is a fundamental right, protected under Article 21 of the Constitution (right to life and personal liberty) and also touching Articles 14 (equality) and 19 (freedom of speech and expression).

Why does this matter for your digital life? Because before Puttaswamy, there was genuine legal ambiguity about whether privacy was constitutionally protected at all. Two earlier Supreme Court decisions — M.P. Sharma (1954) and Kharak Singh (1962) — had cast doubt on it. The government argued in the Aadhaar case that privacy wasn't a fundamental right. The Court disagreed. Decisively. Justice Chandrachud, writing the lead opinion, stated that privacy includes informational privacy — the right to control what personal data is collected about you and how it's used.

That's not abstract philosophy. It has real consequences. When an app demands access to your contacts, location, and camera just to let you play a puzzle game, that implicates your informational privacy. When a company shares your purchase history with advertisers without telling you, that implicates it too. The Puttaswamy judgment didn't create enforcement mechanisms on its own — that came later with legislation — but it established the constitutional foundation that everything else builds on.

Right to Information in the Digital Age

The Right to Information Act, 2005 predates the digital rights conversation by over a decade, but it's become more relevant, not less, as government services move online. RTI gives every citizen the right to request information from public authorities, and they must respond within 30 days. The Act applies to the digital domain in two ways that people don't always realize.

First, you can use RTI to ask government bodies what personal data they hold about you and how they're using it. Filed an Aadhaar-related complaint? You can RTI the UIDAI to check its status and what data they accessed. Wondering whether a government department shared your information with a third party? RTI it. The responses aren't always satisfying — departments sometimes cite exemptions under Section 8 of the Act — but the right to ask is itself powerful. Second, RTI requests can now be filed online through the RTI portal (rtionline.gov.in), making the process accessible to anyone with a smartphone. Before the portal, you had to send physical letters with postal orders. That barrier kept a lot of people from exercising this right. The digital process isn't perfect (the portal has uptime issues and some departments are slow to respond electronically), but it's enormously better than what came before.

The Digital Personal Data Protection Act: Your Rights in Plain Terms

Now let's talk about the law that's probably most directly relevant to your day-to-day digital life: the Digital Personal Data Protection Act, 2023. The DPDP Act was years in the making — the first draft appeared in 2018, got reworked in 2019, scrapped entirely in 2022, and finally passed in August 2023. It's not a perfect law. Privacy advocates have legitimate criticisms. But it gives Indian citizens a set of concrete, enforceable rights over their personal data that didn't exist in statute before.

Here's what you're entitled to under the DPDP Act, in plain terms:

Right to be informed. Before any organization (the Act calls them "data fiduciaries") collects your personal data, they must tell you what they're collecting and why. That notice has to be clear and in plain language — not buried in a 40-page terms of service document that nobody reads. If a shopping app wants to track your location, it needs to say so upfront.

Right to consent. Your data can only be processed with your free, specific, informed consent. You can withdraw that consent at any time, and withdrawing it should be as easy as giving it. If signing up required one tap, opting out shouldn't require emailing customer support and waiting three weeks. The Act is explicit about this, though enforcement will determine how seriously companies take it.

Right to correction and erasure. Found incorrect information in your profile on some service? You have the right to get it corrected. Want your data deleted entirely? You can request that. The data fiduciary has to comply unless there's a legal reason to retain it (tax records, for instance, have mandatory retention periods).

Right to grievance redressal. Every data fiduciary must have a grievance officer. If your complaint isn't resolved satisfactorily, you can escalate to the Data Protection Board of India. The Board has the power to impose penalties — up to 250 crore rupees for serious violations. That's not a slap on the wrist. Whether the Board will actually impose such penalties remains to be seen (it was still being constituted as of late 2025), but the legal authority exists.

Right of nomination. You can nominate someone to exercise your data protection rights in case of your death or incapacity. This is a surprisingly thoughtful provision. Think about all the accounts and data a person accumulates over a lifetime — social media, email, cloud storage, financial apps. Without this right, that data exists in a legal limbo when someone passes away. The nomination provision addresses that, at least partially.

Freedom of Speech Online and Its Limits

Article 19(1)(a) of the Constitution guarantees freedom of speech and expression. Courts have repeatedly confirmed this extends to online speech — your tweets, Instagram posts, YouTube videos, blog articles, and messages on public forums. You have the right to express opinions, criticize public figures and government policies, share news and information, and participate in online debates. The IT Act's Section 66A, which was notoriously used to arrest people for social media posts, was struck down by the Supreme Court in 2015 in the Shreya Singhal vs Union of India case. That judgment was a landmark for online free speech in India.

But — and this is a real but — free speech online isn't absolute. Article 19(2) allows reasonable restrictions on grounds of sovereignty and integrity of India, security of the state, friendly relations with foreign states, public order, decency or morality, contempt of court, defamation, and incitement to an offence. What counts as "reasonable" is where things get complicated. The IT Act's Section 69A gives the government power to block websites and content in the interest of sovereignty, defense, security, or public order. Thousands of URLs get blocked every year under this provision. The process lacks transparency — block orders are often not published, and affected parties sometimes don't know why their content was taken down. The Bombay High Court ruled in 2024 that the government should provide reasons for blocking orders, but compliance with that ruling has been uneven.

There's also the intermediary liability framework under IT Act Section 79 and the IT Rules of 2021. Social media platforms with more than 50 lakh users are classified as "significant social media intermediaries" and must comply with content moderation requirements, including appointing grievance officers in India, removing unlawful content within specified timelines, and enabling traceability of the "first originator" of information in certain cases. That last requirement — traceability — is the one that worries privacy advocates most, because it could potentially break end-to-end encryption. WhatsApp challenged it in court, and the case was still pending as of early 2026.

The Right to Internet Access

The right to access the internet itself has constitutional backing, which is something many Indians don't realize. In January 2020, the Supreme Court ruled in Anuradha Bhasin vs Union of India — a case about the internet shutdown in Jammu and Kashmir — that access to the internet is a medium of exercising the right to free speech and the right to carry on trade or business under Article 19. Internet shutdowns must satisfy the test of proportionality, must be temporary, and must be reviewed by a committee. Indefinite shutdowns are unconstitutional.

India leads the world in internet shutdowns, and that's not a statistic to be proud of. In 2023 alone, the country saw over 100 shutdowns, mostly at the state level during protests, exams, or religious tensions. Each shutdown affects millions of people — not just their ability to browse social media, but their livelihoods, access to healthcare information, educational resources, and emergency services. The Anuradha Bhasin judgment didn't stop shutdowns, but it did establish that they can't happen arbitrarily. If you're affected by an internet shutdown, you have the legal standing to challenge it in court under Article 226 (High Court writ jurisdiction) or Article 32 (Supreme Court).

Net neutrality is another area where India got things surprisingly right. TRAI's 2016 regulation on Discriminatory Tariffs for Data Services and the subsequent Prohibition of Discriminatory Tariffs for Data Services Regulations effectively banned zero-rating practices like Facebook's Free Basics. The principle is straightforward: your internet service provider can't charge you differently based on what websites or apps you access, and it can't speed up or slow down specific services. All internet traffic should be treated equally. These rules prevented the creation of a two-tier internet where wealthy companies could pay ISPs for preferential treatment while smaller sites got left in the slow lane. For a country where millions of people access the internet primarily through affordable data plans, net neutrality isn't theoretical — it directly affects what information they can access and at what cost.

The Right to Be Forgotten

The "right to be forgotten" in India exists, but it's still developing. Unlike the EU's GDPR, which has an explicit right to erasure, Indian law handles this mostly through court orders. The Karnataka High Court recognized the right in a 2017 case involving a woman who wanted her name removed from a criminal case she'd been acquitted in. The Delhi High Court addressed it in a 2021 case where an individual sought removal of personal information from search engine results. The DPDP Act's right to erasure is related but different — it applies to data held by data fiduciaries, not to search engine indexing of public records.

If you want to exercise the right to be forgotten in India today, you'd likely need to petition a High Court, arguing that the continued availability of certain information about you serves no public interest and causes you harm. Success depends heavily on the specifics — courts are more sympathetic when the information involves acquitted criminal cases or resolved personal matters than when it involves genuine matters of public interest. It's an imperfect right, applied case by case, without the systematic framework that European citizens have. But it exists, and it's been used successfully.

How to Exercise These Rights: Practical Steps

So you've got these rights. Great. How do you actually use them when something goes wrong? Let me get specific about the practical steps, because rights without remedy are just words on paper.

If a company misuses your data, start with their grievance officer. Under the DPDP Act, every data fiduciary must have one, and their contact details should be published on the company's website or app. File your complaint in writing (email works). Give them 30 days to respond. If you don't get a satisfactory response, escalate to the Data Protection Board through its portal. Keep copies of everything — your original complaint, the company's response (or lack thereof), and any evidence of the data misuse.

If the government blocks your content or shuts down your internet, document it. Screenshot any block notices. Note the dates and duration. Contact a digital rights organization — the Internet Freedom Foundation (IFF), the Software Freedom Law Centre (SFLC.in), or the Centre for Internet and Society (CIS) all work on these issues and sometimes provide legal support or file public interest litigation. If you're directly affected by an internet shutdown, you can file a writ petition in the relevant High Court. Legal aid is available if cost is a barrier — many High Courts have legal services authorities that can help.

For RTI requests, use rtionline.gov.in. The fee is ten rupees, payable online. Be specific in your questions — vague requests get vague responses. Instead of "What data do you have about me?" try "What personal data, including Aadhaar number, address, and phone number, is held in [specific department/scheme] records for [your name/ID]?" Specificity gets results.

If someone violates your online privacy — publishes your private photos, accesses your accounts without permission, stalks you online — that's a criminal matter under the IT Act. Section 66E covers violation of privacy, Section 66C covers identity theft, and Section 354D covers cyberstalking (though it only applies to women victims, which is a limitation). File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 helpline. You can also file an FIR at your local police station — cyber cells in most cities accept these complaints now, though the quality of investigation varies.

One more right that deserves attention is consumer protection in the digital space. The Consumer Protection Act, 2019, and the Consumer Protection (E-Commerce) Rules, 2020, give you rights specifically as an online consumer. If an e-commerce platform engages in unfair trade practices — hidden charges, fake reviews, manipulative dark patterns, or failure to deliver what was promised — you can file a complaint with the Consumer Disputes Redressal Commission. The process has been digitized through the e-Daakhil portal (edaakhil.nic.in), so you don't even need to physically visit a consumer court. Filing fees are minimal. The CCPA (Central Consumer Protection Authority) has been increasingly active in penalizing companies for misleading advertisements and unfair practices online, which is encouraging even if the pace of action feels slow.

There's also the question of surveillance, which ties back to the Puttaswamy judgment in important ways. The Court didn't just declare privacy a fundamental right — it laid down a four-part test for any government intrusion into privacy. The action must be sanctioned by law, must serve a legitimate aim, must be proportionate to that aim, and must have procedural safeguards against abuse. Government surveillance under Section 69 of the IT Act technically meets the "sanctioned by law" requirement, but whether current surveillance practices satisfy proportionality and procedural safeguards is deeply contested. The government hasn't been transparent about how many surveillance orders are issued annually, who they target, or what oversight mechanisms exist. That opacity itself is arguably a violation of the Puttaswamy framework, though no court has ruled on it directly yet.

A Quiet Republic Day Pledge

This Republic Day, maybe the pledge isn't about grand gestures. Maybe it's quieter than that. Read one section of the DPDP Act — Section 6 on consent, perhaps, or Section 11 on your rights as a data principal. File one RTI request about something that's been bugging you. Check what permissions you've given to apps on your phone and revoke the ones that don't make sense. Tell one friend or family member about the Puttaswamy judgment and what it means for their privacy. These aren't dramatic acts. They're small exercises of citizenship in a republic that gave you these rights 76 years ago and is still, slowly, extending them into the digital spaces where you now spend so much of your life. That's worth something. I'd argue it's worth quite a lot.