By Suman Moktan
Legal Writer & Educator
A smartphone can tell a person’s life story. It can show where someone was, whom they contacted, what they photographed, what they searched for, what they bought, what they discussed, and sometimes even what they were thinking. For an investigator, that information can be extremely valuable. For the owner of the phone, the same information may be deeply private. This is where digital privacy becomes a serious legal concern. Modern criminal procedure now has to deal with a form of personal information that is far more extensive than the evidence traditionally found in paper documents or physical objects.
Suppose the police are investigating one incident that allegedly took place on a particular evening. They may need a few messages, a photograph, a location record or a particular communication. But the phone may contain five years of family conversations, personal photographs, banking information, professional documents and private correspondence. Does the power to investigate one offence justify looking through all of that information? That is the real digital privacy question.
India has already moved towards a legal system that recognises electronic evidence. The Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) expressly recognises electronic communication and devices in criminal procedure, while the Bharatiya Sakshya Adhiniyam, 2023 (BSA) gives electronic and digital records a clear place in the law of evidence. At the same time, the Supreme Court has recognised privacy as a fundamental right and has developed a proportionality framework for examining State interference with that right. The difficult part is bringing these principles together in the everyday reality of a police investigation.
The smartphone has changed what a “search” means
Traditional criminal investigations were built largely around physical evidence. If police searched a house, they might be looking for a weapon, a document, stolen property or another object connected with an offence. The material could generally be identified, seized and placed on record. A smartphone is fundamentally different.
One small device can contain thousands of pieces of information belonging to different periods of a person’s life. Some may be directly relevant to an investigation. Much of it may have nothing to do with the case. This creates an important distinction between taking possession of a device and examining the information contained in it. The first is about the physical object. The second can amount to an examination of a person’s digital life.
That distinction becomes even more significant when forensic tools are capable of extracting large quantities of information quickly. The technical ability to access data can therefore be much broader than the legal purpose for which the device was originally obtained. The question is no longer simply whether investigators can find evidence.
The question is whether the law clearly defines how far they can look for it.
India’s new criminal procedure recognises electronic evidence
The BNSS came into force on July 1, 2024, and replaced the Code of Criminal Procedure, 1973. The Indian Code identifies it as the law consolidating and amending criminal procedure. The legislation recognises the reality that modern investigations may involve electronic communication and digital devices.
Section 94 is particularly relevant. It provides a mechanism for requiring the production of a document or other thing considered necessary or desirable for an investigation, inquiry, trial or other proceeding, and expressly includes electronic communication, including communication devices, within its scope.
The BNSS also requires the police report to record the sequence of custody in cases involving an electronic device. That is significant because digital evidence has to be accounted for from the point at which it enters the investigation. This is a clear recognition of the digital character of modern criminal investigations. But recognising digital evidence does not automatically answer every question about digital searches.
A law may permit investigators to obtain a device or electronic communication. A separate question remains: what should happen when that device contains a huge amount of information that has nothing to do with the alleged offence? That is where privacy and proportionality become important.
The law of evidence has also moved into the digital age
The Bharatiya Sakshya Adhiniyam, 2023 gives electronic and digital records a defined place within Indian evidence law. Section 61 states that an electronic or digital record cannot be denied legal effect merely because it is electronic or digital, subject to the requirements of the Act. Section 62 deals with proof of the contents of electronic records, while Section 63 provides the specific framework for their admissibility. This matters because electronic evidence is no longer an unusual category of evidence.
A photograph from a phone, an electronic communication, a digital document or another electronic record may become relevant in criminal proceedings. But admissibility is only one part of the story. Before a digital record reaches the courtroom, investigators have to deal with questions of preservation, extraction, authenticity and chain of custody. And before investigators even get to that stage, they must confront another question: How much personal information should they have been allowed to examine in the first place?
A phone may contain much more than the investigation requires
Consider a simple example. A person is being investigated in connection with an incident that occurred on June 10 between 7 p.m. and 9 p.m. Investigators may reasonably need communications and location information relating to that period. They may also need messages exchanged with a particular person connected with the incident.
But the same phone may contain several years of photographs, family conversations, personal notes, financial information and professional correspondence. The investigative purpose may therefore be narrow even though the available digital information is enormous. This is the central difficulty.
With physical evidence, the object itself may be relatively limited. With digital evidence, the same device can open access to an entire history. The law therefore needs to distinguish between what can technically be accessed and what is legally necessary to investigate the offence.
Privacy does not mean immunity from investigation
The right to privacy is sometimes discussed as though it creates an absolute barrier around personal information. That is not the constitutional position. The Supreme Court recognised privacy as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India. The Court’s subsequent jurisprudence has developed the principle that restrictions on fundamental rights must satisfy constitutional requirements, including legality, a legitimate state aim and proportionality. This distinction matters in criminal investigation.
A person cannot reasonably claim that evidence relevant to a serious offence is automatically protected merely because it is stored on a private phone. At the same time, the existence of an investigation does not mean that every piece of information on the phone automatically becomes relevant. The constitutional question lies between these two positions.
The State may have a legitimate interest in investigating crime. The individual has an interest in preventing unnecessary intrusion into private life. The law has to determine where those interests meet.
The proportionality question
The idea of proportionality becomes particularly useful when dealing with digital searches. Imagine that investigators need one particular conversation from a particular week. If they have a method of obtaining that information without examining years of unrelated material, that narrower approach may raise fewer privacy concerns.
On the other hand, there may be investigations where broader access is genuinely necessary because the relevant evidence cannot be identified in advance. The point is not that every digital search must be narrow in the same way. The point is that the scope of access should have a rational connection with the investigative purpose.
The Supreme Court has described the privacy framework emerging from Puttaswamy in terms of legality, a legitimate State aim and proportionality. For digital investigations, this raises practical questions:
- What is the offence being investigated?
- What information is actually required?
- Why is that information necessary?
- Could the same evidence be obtained through a less intrusive method?
- How should unrelated information discovered during the search be handled?
These are not merely theoretical questions. They determine how privacy will work in practice.
The problem becomes larger when other people’s information is involved
A smartphone does not contain information belonging only to its owner. A WhatsApp conversation may contain another person’s messages. A lawyer’s phone may contain confidential information belonging to clients. A journalist’s device may contain information identifying sources. A doctor’s device may contain patient-related information. This means a digital search can affect the privacy or confidentiality of people who are not suspects in the case.
The Supreme Court’s 2025 directions concerning digital devices and advocates illustrate this problem. In that matter, the Court directed that examination of a digital device be handled in a way that protects confidentiality concerning other clients and that any discovery be confined to what the investigating officer was permitted to seek, where legally permissible. The principle has wider significance.
When police access a digital device, they may not be entering the digital life of only one person. They may also encounter information involving dozens or even hundreds of other people. A modern digital-search framework therefore has to consider third-party privacy as well.
Journalists, lawyers and professionals present special problems
The issue becomes even more sensitive when a device contains professionally protected information. A journalist may have communications with confidential sources. A lawyer may have privileged communications with clients. A doctor may possess sensitive patient information. A company executive may hold confidential business material. A broad digital search can therefore create consequences far beyond the original criminal investigation.
This does not mean that professional status makes a device immune from lawful investigation.
It means that the method of examination may need additional safeguards.
The Supreme Court’s approach to advocates’ digital devices shows one possible direction: identify the material sought, provide an opportunity for objections where appropriate, use technical assistance where required and take care that confidential information relating to others is not unnecessarily exposed. The larger lesson is simple.
Digital searches require more precision because digital devices contain more information than most physical evidence ever did.
What happens to information that has nothing to do with the case?
This is one of the more difficult questions in digital investigations. Assume that cops legitimately check a phone and uncover a substantial amount of information irrelevant to the offense under investigation.
Should that information be kept?
Can it be copied?
Who has access to it?
Can it be used for future investigations?
When should it be deleted?
These inquiries are especially relevant when forensic investigators generate a complete image or replica of a device. Once information has been duplicated, the privacy issue does not necessarily disappear when the original phone is returned. The copied data may persist in forensic systems, storage devices, or investigation records.
This is why a modern digital-evidence framework must include regulations for not only collection, but also retention, access, use, and disposal.
Digital evidence needs a chain of custody
Privacy is just one aspect of the problem. The other concept is evidentiary reliability. If a digital record is to be used in court, investigators should be able to explain how it was collected and stored.
Who seized the device?
When was it seized?
Who handled it?
How was the data extracted?
Was the original gadget altered?
Was a forensic copy made?
Who examined the copy?
Was the process documented?
These considerations are crucial because digital information is much easier to copy, move, change, or destroy than many tangible types of evidence.
When an electronic device is involved, the BNSS expressly demands that the chain of custody be documented in the police report. Meanwhile, the BSA establishes a legal framework for using electronic and digital documents as evidence. Together, these clauses demonstrate that India’s new criminal-law framework recognizes the value of digital evidence. The ongoing problem is to ensure that the acquisition and handling of that material is both legally justified and technically reliable.
Cloud storage has made the problem even more complicated
A modern phone is frequently the visible component of a much larger digital system. Photographs may be saved in the cloud. Messages may be backed up remotely. Documents may reside in internet storage. A person’s account may synchronize data across many devices. This means that searching a phone may sometimes result in information that was not physically stored on the phone at the time of the search.
The Supreme Court has already heard cases involving access to cloud backups. In an October 2025 order involving digital devices, the Court documented arguments on access to iCloud/cloud backups and device forensic examination.
As cloud computing advances, the traditional concept of a “device search” becomes more complex. Instead of being contained within a single physical object, important evidence can be distributed over a network. This presents issues of jurisdiction, authorization, preservation, and the scope of allowed access.
India’s data-protection framework is another part of the picture
India passed the Digital Personal Data Protection Act of 2023 to establish a framework for processing digital personal data while acknowledging both an individual’s desire to protect personal data and the necessity to process data for authorized purposes.
The government issued the Digital Personal Data Protection Rules, 2025 in November 2025. The Rules provide for a phased implementation, with some provisions taking effect immediately and others coming into force one year or eighteen months following publication.
That staggered adoption is critical when analyzing India’s current data protection policy. The mere existence of the Act and Rules does not imply that all substantive provisions are already operational. More crucially, data protection and criminal procedure address separate issues.
The DPDP framework addresses the processing and protection of digital personal data within its statutory scope. A criminal inquiry presents new problems about police authority, search and seizure, evidence, forensic examination, and court scrutiny. As a result, the two areas must collaborate, yet neither can be viewed as a complete alternative.
The law needs to distinguish seizure from examination
This could be the most important distinction for the future of digital criminal proceedings. Seizing a phone entails gaining control of the actual device. Examining a phone entails obtaining the information stored within it. These acts can have quite different privacy implications.
A legal system that regards them as if they are identical may struggle to provide effective privacy protection. A more explicit approach may compel investigators and, where applicable, judges to specify the objective of the digital review, the types of information requested, and the time period or accounts relevant to the investigation.
The framework could also include protocols for dealing with privileged, confidential, and clearly irrelevant material. Such measures would not necessarily exclude investigators from gathering critical evidence. They would define the search’s boundaries more clearly.
The police also need workable rules
It is easy to discuss digital privacy only from the perspective of the person whose device has been seized. But investigators face genuine practical problems. Digital evidence can disappear quickly. Messages may be deleted. Accounts can be modified. Devices can be reset. Cloud information may change. Criminal networks can use encrypted communications and multiple platforms.
Investigators therefore need effective methods to preserve and obtain digital evidence. A legal system that creates procedures that are too vague, slow or technically unrealistic can create problems for legitimate investigations. The answer is therefore not to make digital evidence inaccessible.
The better approach is to create clear rules that allow necessary evidence to be collected while limiting unnecessary intrusion. That requires properly trained investigators, forensic specialists, documented procedures and appropriate judicial oversight.
What could a better digital-search framework look like?
There is no single formula that will work for every investigation. A homicide investigation may require a different approach from a financial-fraud investigation. A cybercrime investigation may involve a much larger volume of digital material than a simple assault case. But certain principles can provide a common framework.
The investigator should be able to identify the offence being investigated and explain why particular digital information is relevant. The search should be connected to that purpose. Where a broader search is necessary, the reasons for its breadth should be capable of explanation and review. There should also be procedures for handling information belonging to lawyers, journalists, doctors and other professionals where confidentiality or privilege is involved.
Finally, there should be clear rules about what happens after the evidence has been extracted. A digital copy should not remain indefinitely simply because it was once lawfully obtained.The central principle should be:
The authority to investigate an offence should not automatically become authority to explore every aspect of a person’s digital life.
Five questions every digital search should raise
A useful way of understanding the problem is to ask five basic questions.
1. What offence is being investigated?
The search should have a defined investigative purpose.
2. What information is actually relevant?
The fact that information exists on a phone does not make it relevant to the case.
3. What legal authority permits access?
The source and scope of the authority should be identifiable.
4. How will unrelated information be protected?
Digital searches can expose information belonging to family members, clients, sources, patients and other third parties.
5. What happens to the information afterwards?
Retention, copying, access and deletion are part of the privacy question.
These questions do not weaken criminal investigations. They make the investigation more accountable.
The real challenge is not technology. It is legal boundaries.
India’s criminal justice system has already accepted that digital evidence is part of modern investigation. The BNSS recognises electronic communication and devices. The BSA gives electronic and digital records a defined evidentiary framework. The DPDP Act and Rules create a broader data-protection regime. The Supreme Court’s privacy jurisprudence provides constitutional principles for examining State intrusion, while recent proceedings involving digital devices show that courts are confronting practical questions about confidentiality and access. The harder task is translating these principles into everyday investigative practice.
A smartphone is not merely another object that happens to contain evidence. It may contain years of personal history. That changes the legal character of a search. The police may need access to a particular message. A court may need a particular photograph. An investigator may need location information from a particular period. But the existence of those relevant items does not automatically explain why everything else on the device should be examined. That is where the principle of proportionality becomes meaningful.
Conclusion: The future of privacy may be decided inside our phones
The next major privacy questions will not necessarily arise from dramatic surveillance systems. They may arise from an ordinary phone lying on an evidence table. Inside that phone may be the evidence needed to solve a crime. Inside the same phone may be private conversations, family photographs, financial information, professional communications and information belonging to people who have nothing to do with the investigation. The challenge for Indian law is therefore not to choose between privacy and effective investigation. It is to develop rules that allow both to exist.
The legal system needs to answer some basic questions with greater precision: What can be searched? What must be searched? Who authorises it? How much information is necessary? How are irrelevant records protected? How are confidential communications handled? How long can extracted information be retained? These questions will become more important as criminal investigations depend increasingly on smartphones, cloud storage, social-media accounts and other digital platforms. The central principle is simple. A phone may be evidence, but it is also a window into a person’s private life. The law has recognised the first reality. The difficult work now is defining the limits of the second.
Legal note: This article is intended for general legal education and discussion. It should not be treated as legal advice. The Supreme Court proceedings mentioned above are reported as they stood at the relevant dates, and pending proceedings should not be presented as final rulings.
