Digital constitutionalism in the age of transnational data flows: challenges for law and justice ina globalised world
Keywords:
Digital Constitutionalism, Transnational Data Flows, Data Privacy, Indian Constitution, Data SovereigntyAbstract
As we navigate the world of globalisation and digitalisation, India’s constitutional framework is finding itself at a crossroads. The flow of data across borders is challenging the established ideas about sovereignty, privacy and justice. This paper looks at how the courts have changed in response to these digital changes especially focusing on Articles 14, 19 and 21. It also looks at important
Supreme Court cases like Justice K.S. Puttaswamy (Retd.) v. Union of India. The paper carefully examines Digital Personal Data Protection Act 2023 and the Draft Rules 2025 and points out the ongoing issues with where the law applies and how well it is being enforced. By using a legal and comparative approach it draws on insights from the Global South and considers how data
governance can sometimes be seen as neo-colonial as seen in the Pegasus spyware scandal and other major data breaches like Star Health. Finally, the paper offers ideas to help India become more resilient in its constitution and to create a digital system that respects its sovereignty.
References
Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
Amnesty International, ‘India: Damning new forensic investigation reveals repeated use of Pegasus spyware to
target high-profile journalists’(28 December 2023).
Carly Page, ‘Air India Data Breach: Hackers Access Personal Details Of 4.5 Million Customers’ (Forbes, 23
May 2021).
Sprinto, ‘Star Health Insurance Data Breach: Lessons In Cybersecurity’ (Sprinto, 31 January 2025).
Digital Personal Data Protection Act 2023.
Ministry of Electronics and Information Technology, Draft Digital Personal Data Protection Rules 2025 (MeitY
.
Digital Personal Data Protection Act 2023 (n 5) s 17.
Nick Couldry and Ulises A Mejias, The Costs of Connection: How Data Is Colonizing Human Life and
Appropriating It for Capitalism (Stanford University Press 2019).
Edoardo Celeste, Digital Constitutionalism: The Role of Internet Bills of Rights (Routledge 2022).
Pradip Ninan Thomas, Digital India: Understanding Information, Communication and Social Change (SAGE
Publications 2012).
Personal Information Protection Law of the People’s Republic of China (2021).
Lei Geral de Protecao de Dados Pessoais (LGPD) (Law No 13,709/2018) (Brazil).
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1.
Constitution of India, arts 14, 19, 21, 253, 51(c).
Shreya Singhal v Union of India AIR 2015 SC 1523.
Justice KS Puttaswamy (Retd) v Union of India (n 1).
ibid para 325
Amnesty International (n 2).
Digital Personal Data Protection Act 2023 (n 5).
ibid ss 5, 6, 8.
Draft Digital Personal Data Protection Rules 2025 (n 6).
Digital Personal Data Protection Act 2023 (n 5) s 17.
Justice KS Puttaswamy (Retd) v Union of India (n 1).
Shreya Singhal v Union of India (n 15).
Kaushal Kishor v State of Uttar Pradesh (2023) 4 SCC 1.
Manohar Lal Sharma v Union of India (2021) SCC OnLine SC 985.
ibid.
Clarifying Lawful Overseas Use of Data Act Pub L No 115-141, 132 Stat 348 (2018) (US).
Amnesty International (n 2).
ibid.
Manohar Lal Sharma v Union of India (n 26).
WhatsApp Inc v NSO Group Technologies Ltd (ND Cal, 6 May 2025).
Kratikal, ‘Data Breach Strikes Hathway: 41.5M Data Exposed’ (Kratikal, 23 January 2024).
Breachsense, ‘Fortis Data Breach in 2024’ (Breachsense, 2024).
Dark Reading, ‘Indian Car-Sharing Firm Zoomcar Latest to Suffer Breach’ (Dark Reading, 17 June 2025).
Halock, ‘Dell Computer Data Breach Potentially Impacts 49 million Customers’ (Halock, 25 September 2025).
IBM, Cost of a Data Breach Report 2025 (IBM 2025).
Couldry and Mejias (n 8).
Digital Personal Data Protection Act 2023 (n 5).
General Data Protection Regulation (n 13).
ibid art 83.
Enforcement Tracker, ‘GDPR Enforcement Tracker’.
Personal Information Protection Law (n 11).
Lei Geral de Proteção de Dados Pessoais (n 12).
Autoridade Nacional de Proteção de Dados, ‘Annual Report 2024’ (2024).
Nigeria Data Protection Act 2023 (Nigeria).
Law No 27 of 2022 concerning Personal Data Protection (Indonesia).
DLA Piper, Data Protection Laws of the World (DLA Piper 2025).
UNCTAD, Digital Economy Report 2024 (UNCTAD 2024).
ibid.
Draft Digital Personal Data Protection Rules 2025 (n 6).
Justice KS Puttaswamy (Retd) v Union of India (n 1).
Clarifying Lawful Overseas Use of Data Act (n 28).
Lei Geral de Proteção de Dados Pessoais (n 12).
Constitution of India, art 21A.
Star Health data breach (n 4).
G20, ‘New Delhi Leaders’ Declaration’ (9-10 September 2023).
Pegasus spyware scandal (n 2).
Government of India, ‘Atmanirbhar Bharat Abhiyan’ (2020).
Air India data breach (n 3).
Hathway ISP breach (n 33).
Data Security Council of India, India Cyber Threat Report 2025 (DSCI 2025).
WhatsApp Inc v NSO Group Technologies Ltd (n 32).
Shreya Singhal v Union of India (n 15).
Justice KS Puttaswamy (Retd) v Union of India (n 1).
Digital Personal Data Protection Act 2023 (n 5).
General Data Protection Regulation (n 13).
Personal Information Protection Law (n 11).
Lei Geral de Proteção de Dados Pessoais (n 12).
Protection of Personal Information Act 4 of 2013 (South Africa).
Couldry and Mejias (n 8).
