Digital Health Surveillance in Public Health Emergencies: Testing the DPDP Act, 2023 Against India's COVID-19 Experience

The COVID-19 pandemic accelerated the adoption of digital health surveillance across India, prompting government bodies to deploy contact tracing applications, location tracking and geo-fencing to manage public health risks. These rapid technological interventions, however, raised serious constitutional and data privacy concerns, particularly about the handling of sensitive health information without robust statutory backing. This paper evaluates India’s pandemic-era digital health measures through the constitutional lens of K.S. Puttaswamy v. Union of India (2017) and assesses the evolution of the governing legal framework. It shows how the legacy framework under the Information Technology Act, 2000 and the IT Rules, 2011 proved structurally incapable of regulating State-led health surveillance. The paper then examines the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025, scrutinising in particular the broad ‘legitimate use’ exceptions for public health emergencies, the State exemptions, data principal rights and executive oversight of the Data Protection Board. It argues that while the DPDP Act provides a long-awaited statutory base, significant regulatory gaps remain. To ensure that public health interventions respect fundamental rights, the paper proposes statutory safeguards, binding emergency protocols and enhanced judicial and institutional oversight.