How can India balance AI-led innovation with the constitutional right to privacy?

In K.S. Puttaswamy (2017), the Supreme Court held that privacy is a fundamental right under Article 21. Any intrusion on it must meet the tests of legality, necessity and proportionality [1]. AI models trained on personal data can memorise that data and later regurgitate it in their outputs [4]. India therefore needs targeted safeguards that protect privacy without stifling innovation.

Where AI and privacy collide

• Erasure gap: Data Fiduciaries must handle erasure requests within a set time limit [2]. Deleting the source file does not remove data already absorbed into model weights [4].
• Scraping loophole: The DPDP Act excludes personal data that a person has made public [3]. This lets AI developers scrape it without consent. The OECD flags web scraping as a key privacy risk [4].
• State exemptions: The government can exempt its own agencies. PRS warns that this could enable broad profiling of citizens [3].
• Transition gap: The DPDP Rules, 2025 are being phased in over 18 months, which leaves protections incomplete for now [2].

Balancing measures

• Targeted legal amendments: The India AI Governance Guidelines rely on existing laws rather than a new AI statute [5]. India should amend the DPDP Act to bring AI training on scraped public data within its scope.
• Privacy-by-design: MeitY's DEPA framework proposes training models in secure data environments using differential privacy, so raw data is never exposed [6].
• Audit lever: Significant Data Fiduciaries already have to carry out independent audits and Data Protection Impact Assessments [2]. These should include tests for regurgitation.
• Regulatory guidance: The Data Protection Board should define what counts as valid erasure for a trained model. It should also promote research on machine unlearning, which the OECD treats as a promising but still unproven tool [4].
• Innovation-friendly compliance: The simplified compliance framework for start-ups lowers the cost of compliance [7].
• Proportionate State use: Any use of exempted government data for AI training should pass the Puttaswamy proportionality test [1][3].

Protecting privacy and promoting innovation can go together, provided the safeguards are calibrated rather than prohibitive. Targeted DPDP amendments, privacy-preserving training infrastructure and a technically capable Data Protection Board can make Indian AI trustworthy. This approach upholds the constitutional promise of dignity and autonomy while keeping India competitive in AI.