Privacy in the Crosshairs: Legal Implications of the Income Tax Bill, 2026 and Digital Surveillance Powers

Introduction

In the age of pervasive digitization, where personal data circulates across multiple platforms and devices, the boundaries between public authority and private life are being constantly renegotiated. The proposed Income Tax Bill, 2025, set to replace the archaic Income-tax Act of 1961 and to come into force from April 1, 2026, is a landmark development in India’s fiscal legislation.¹ Touted as a simplification measure aimed at improving compliance, curbing litigation, and aligning tax governance with modern technological realities, the Bill encapsulates the government’s ambition to modernize its tax architecture.

However, embedded within this progressive shift is a provision that has stirred legal, ethical, and constitutional controversy: Clause 247, which grants sweeping powers to tax officials to access an individual’s virtual digital space, including emails, cloud storage, social media, and even encrypted personal devices.²

While the intention may be to detect tax evasion in an increasingly digital economy, the implications of this clause are far-reaching. The legal community has raised concerns about potential violations of the fundamental right to privacy, as recognized in the Supreme Court’s seminal judgment in Justice K.S. Puttaswamy v. Union of India (2017).³ Furthermore, the provision’s vague drafting, lack of judicial oversight, and potential conflict with the Digital Personal Data Protection (DPDP) Act, 2023,⁵ raise serious questions about proportionality, necessity, and procedural safeguards.

This article critically examines the provisions of the new Bill from a legal perspective, exploring its compatibility with constitutional rights and India’s data protection framework, and interrogates whether the state’s growing digital gaze can be reconciled with civil liberties.

Digital Enforcement and the Expansion of Clause 247

Clause 247 of the Income Tax Bill, 2025 authorizes income tax officers to enter and search any “virtual digital space” of an assessee during investigation or search operations, which includes the power to break open passcodes, gain access to encrypted data, and examine communications across platforms.⁵ The term “virtual digital space” itself is defined in the Bill as encompassing not only traditional computers and servers but also mobile phones, cloud infrastructure, social media accounts, and any digital platform where financial or personal data may reside.⁶

This provision is a significant departure from the search and seizure powers under the old Income-tax Act, 1961, specifically Section 132, which allowed search of physical premises and documents but did not explicitly authorize intrusion into digital privacy.⁷ By contrast, Clause 247 empowers tax authorities to override encryption protocols and compel access to private digital assets, all without the necessity of prior judicial approval or independent oversight.⁸ This enhanced digital power is justified by the state on the grounds of combating sophisticated tax evasion schemes that now operate in cyberspace. But given the post-Puttaswamy jurisprudence on the right to privacy, the scope and depth of these authorities raise concerns about constitutional protections.⁸

Privacy Jurisprudence and the Test of Proportionality

The right to privacy, as held in Justice K.S. Puttaswamy v. Union of India (2017), is a constitutionally protected right implicit in the right to life and personal liberty under Article 21.⁹ The judgment laid down a threefold test for any state action that infringes upon privacy: legality (existence of law), necessity (legitimate state aim), and proportionality (least intrusive means).¹⁰ Although Clause 247 is statutory, thereby satisfying the requirement of legality, it falters when assessed under the tests of necessity and proportionality.¹¹

First, the provision does not mandate any threshold standard of evidence before authorizing digital searches. A tax official’s subjective “reason to believe” is deemed sufficient to trigger digital intrusion.¹² Second, there are no procedural safeguards such as prior judicial sanction, post-search review, or redressal mechanisms for unlawful data collection. In the absence of such guardrails, the proportionality principle is compromised.¹³ The sweeping nature of Clause 247, when viewed through the lens of the Puttaswamy decision, appears to enable surveillance that is neither necessary nor minimally intrusive, thus making it constitutionally vulnerable.¹⁴

Moreover, the power to access private communications and digital content without notice or consent risks chilling the exercise of free speech and expression, further implicating Article 19(1)(a) of the Constitution.¹⁵ Individuals, fearing arbitrary scrutiny, may be discouraged from engaging freely on digital platforms, thereby undermining the democratic fabric of discourse and dissent.

Conflict with the Digital Personal Data Protection Act, 2023

The DPDP Act, 2023, India’s first comprehensive data protection legislation, seeks to safeguard personal data from unlawful processing and mandates that data collection must be based on informed consent, with specific notice requirements, data minimization principles, and user rights including access, correction, and erasure.¹⁶ It also establishes the Data Protection Board to adjudicate complaints and oversee compliance.

Clause 247 of the Income Tax Bill stands in stark contrast to the spirit of the DPDP Act. By allowing coercive access to personal data without consent or notice, it effectively overrides the consent-centric model of data protection.¹⁷ It also fails to specify data retention limits, usage purposes, or destruction protocols post-investigation, leaving scope for misuse, unauthorized sharing, or indefinite storage of private data by state agencies.¹⁸ This creates a legal inconsistency between two central legislations, with the tax law threatening to hollow out the safeguards offered by the data protection regime.¹⁹

In any democratic legal framework, sectoral statutes such as tax laws must operate harmoniously with overarching constitutional and rights-based legislation.²⁰ The absence of an explicit harmonization clause or a judicial interpretation mechanism further complicates the legal terrain, setting the stage for inevitable constitutional litigation.

Judicial Oversight and Comparative Jurisprudence

The absence of judicial or quasi-judicial oversight in Clause 247 is particularly concerning. In comparative jurisdictions, such as the United States, any governmental attempt to access private digital content generally requires a search warrant issued by a competent court, in accordance with the Fourth Amendment’s protection against unreasonable searches and seizures.²¹ Similarly, in the United Kingdom, the Investigatory Powers Act, 2016, although controversial, includes specific procedures for judicial authorization before access to electronic communications.²²

India’s lack of such procedural safeguards in the tax domain represents a regulatory gap. Even existing surveillance frameworks under Section 69 of the Information Technology Act, 2000, which authorizes decryption or interception of information, require prior approval from competent authorities and are subject to departmental and judicial scrutiny.²³ In contrast, Clause 247 creates a parallel system of unchecked access, potentially opening the floodgates to arbitrary intrusion and privacy violations.²⁴

The principle of institutional accountability mandates that executive discretion, particularly in matters as sensitive as privacy and digital access, must be subject to independent review. The inclusion of judicial safeguards not only upholds constitutional fidelity but also builds public trust in governance institutions.²⁵

Towards a Constitutionally Compatible Framework

Given the legitimate objectives of tax compliance and curbing digital black money, a complete rejection of digital powers may not be realistic. However, a calibrated and constitutionally compatible approach is both necessary and possible. The Income Tax Bill should incorporate the following reforms:

• Mandating judicial authorization before any digital search or seizure is conducted;
• Specifying that digital access must be narrowly tailored to the scope of the investigation;
• Ensuring that data collected is used solely for tax purposes and is subject to time-bound deletion protocols;
• Granting the taxpayer the right to be informed post-search and to seek remedy in case of unlawful access.²⁶

Such reforms would align the Bill with constitutional mandates under Articles 14, 19, and 21,²⁷ as well as with India’s obligations under the DPDP Act and international human rights standards.²⁸ The pursuit of economic regulation must not come at the expense of democratic values, and the law must always act as a bulwark against the overreach of executive authority.

Conclusion

The Income Tax Bill, 2025, with its aim of fiscal modernization and digital compliance, is a necessary step in India’s evolving economic landscape. However, its expanded enforcement mechanisms—especially the provision empowering authorities to penetrate private digital domains—require a careful and critical constitutional audit.

Clause 247, in its present form, raises legitimate fears of state overreach, undermines the principles of data protection, and potentially violates the fundamental right to privacy.³ The future of this legislation must be guided by the principle that while the state has the authority to enforce tax obligations, it must do so within the framework of constitutional morality, procedural fairness, and respect for individual autonomy.²⁹ In a data-driven democracy, privacy is not a privilege—it is a right, and any erosion of that right, even in the name of efficiency, demands the highest level of legal scrutiny.³⁰

References

1. Income Tax Bill, 2025 (Proposed)
2. Clause 247, Income Tax Bill, 2025
3. Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1
4. Digital Personal Data Protection Act, 2023
5. Clause 247(1), Income Tax Bill, 2025
6. Ibid
7. Income-tax Act, 1961, s 132
8. Income Tax Bill, 2025, Clause 247(2)-(3)
9. Constitution of India, art 21
10. Puttaswamy (n 3) [638]
11. Ibid
12. Clause 247(4), Income Tax Bill, 2025
13. Puttaswamy (n 3) [310], [412]
14. Ibid
15. Constitution of India, art 19(1)(a)
16. Digital Personal Data Protection Act, 2023, ss 5–11
17. Ibid, s 7
18. Ibid, s 15
19. Ibid, s 22
20. S. Puttaswamy (n 3) [638], [651]
21. US Constitution, amend IV
22. Investigatory Powers Act 2016 (UK), ss 23–29
23. Information Technology Act 2000, s 69
24. Clause 247, Income Tax Bill, 2025
25. Puttaswamy (n 3) [453]
26. Digital Personal Data Protection Act 2023, s 27; Constitution of India, arts 14, 21
27. Constitution of India, arts 14, 19, 21
28. Universal Declaration of Human Rights 1948, art 12; International Covenant on Civil and Political Rights 1966, art 17
29. Puttaswamy (n 3) [638], [697]
30. Ibid