📚Civic Action

How to protect your digital privacy from family under the DPDP Act

When your brother snoops through your chats and tells your parents, it's not just a family fight—it's a violation of your fundamental right to privacy.

HowToHelp Editorial
10 min read
#right to privacy india#DPDP Act 2023#IT Act Section 66E#Puttaswamy judgment#digital privacy family#cybercrime reporting india#fundamental rights article 21

1. The Hook

You leave your phone on the charging dock for ten minutes. In that window, your brother unlocks it, scrolls through your private Instagram DMs, and takes photos of your chats to show your parents. Suddenly, a private joke or a personal vent becomes a full-blown family trial. You feel violated, exposed, and honestly, a bit scared. In many Indian households, the concept of "privacy" is treated like a Western luxury we can’t afford. But here is the truth: your digital life belongs to you. Whether it is a sibling or a relative, snooping into your personal data without consent is not just "bad behaviour"—it is a breach of your fundamental rights.

2. What the law actually says

In India, privacy is not just a vibe; it is a Constitutional mandate.

The Fundamental Right to Privacy In the landmark case Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), a nine-judge bench of the Supreme Court of India unanimously declared that the Right to Privacy is a fundamental right under Article 21 of the Constitution. This means you have a "reasonable expectation of privacy" even within your home. The Court noted that privacy includes "informational privacy"—the right to control how your personal data is accessed and shared.

Digital Personal Data Protection Act (DPDP), 2023 The DPDP Act is India's primary law for digital data. Under Section 4, personal data can only be processed for a lawful purpose for which the "Data Principal" (that is you) has given consent. While the Act primarily regulates companies, it sets the national standard: no one should access your digital personal data without your permission. If a family member uses your phone to extract data to cause you harm or distress, they are violating the spirit of this protection.

Information Technology Act, 2000 If the snooping goes beyond just reading and involves taking screenshots or sharing your private photos/videos, Section 66E of the IT Act comes into play. It punishes the intentional violation of privacy by capturing or transmitting images of a person’s private area without consent. Furthermore, Section 72 deals with the penalty for breach of confidentiality and privacy if someone with access to electronic records discloses them without your permission.

Bharatiya Nyaya Sanhita (BNS), 2023 If your brother or parents use these chats to threaten you, it may constitute "Criminal Intimidation" under Section 351 of the BNS. If your brother is a minor (under 18), his actions are governed by the Juvenile Justice (Care and Protection of Children) Act, 2015, which focuses on reform rather than jail time, but the principle remains: your data is yours.

3. Step-by-step playbook

If your privacy has been breached, or you fear it will be, follow this guide to secure your digital space and assert your rights.

Step 1: Immediate Digital Lockdown

Before you argue, you must secure your devices to prevent further leaks.

  • Change all passwords: Do not use birthdays, pet names, or patterns your brother can guess. Use a passphrase (e.g., BlueCoffee@2026).
  • Enable Two-Factor Authentication (2FA): Use an app like Google Authenticator rather than SMS, as siblings might see the preview of an OTP on your lock screen.
  • App Locks: Use the built-in app lock features in OxygenOS, OneUI, or iOS to lock WhatsApp, Instagram, and your Gallery specifically.
  • Hidden Folders: Use "Secure Folder" (Samsung) or "Hidden Album" (iPhone) to store sensitive screenshots or documents.

Step 2: Documentation (The "Civic" Habit)

If the situation escalates to threats or blackmail, you need a record.

  • What to bring: Take screenshots of any messages where the person admits to snooping or uses the stolen info to threaten you.
  • Timeline: Do this immediately. In digital disputes, evidence can be deleted in seconds.
  • Storage: Upload these screenshots to a private cloud drive (like a separate ProtonDrive or Google Drive) that is not logged in on your primary phone.

Step 3: The "Rights-Based" Conversation

When the "family meeting" happens, move the conversation from "What did you say in the chat?" to "Why was my privacy violated?"

  • What to say: "Under the Supreme Court's Puttaswamy judgment, I have a fundamental right to privacy. Accessing my phone without my consent is a breach of trust and a violation of my digital rights."
  • The Goal: You are setting a boundary. Remind them that while they are your family, your digital identity is protected by the same laws that protect their bank accounts and Aadhaar data.

Step 4: Seek External Support

If you are being physically harmed or severely intimidated because of the exposed chats:

Step 5: Reporting to the Cyber Cell

If your brother has shared your private photos or chats on public platforms or with outsiders to harass you:

For more ways to protect your digital footprint, Browse all civic-action guides.

Where it usually breaks

Even with the law on your side, the "Indian Family Dynamic" is a tough boss to beat. Here is where your privacy plan might hit a wall and how to climb over it.

  1. The "Ghar ki Baat" (Family Matter) Dismissal: If you try to involve an authority figure or even a local lawyer, they might laugh it off as a sibling spat.

    • Workaround: Don't frame it as "he read my messages." Frame it as "unauthorised access to sensitive personal data" and "criminal intimidation" (Section 351 of the BNS). When you use the specific legal terms found in the DPDP Act 2023, people start taking you seriously.
  2. The "I Pay the Bills" Argument: Your parents might claim that because they bought the phone and pay for the ₹719 monthly recharge, they own the data inside it.

    • Workaround: Legally, this is false. The Supreme Court in Puttaswamy (2017) established that privacy is "attached to the person," not the device. Ownership of the hardware does not grant ownership of your private thoughts or digital identity. Remind them (politely) that even a tenant has privacy in a rented house; the landlord can't just walk in because they own the building.
  3. The Cyber Cell Bottleneck: If you try to report the breach on the National Cyber Crime Reporting Portal (cybercrime.gov.in), you might find the "Category of Complaint" confusing.

    • Workaround: Select "Report Women/Child Related Crime" if applicable, or "Any Other Cyber Crime." In the description, clearly state: "Breach of informational privacy and unauthorised data extraction under Section 66E of the IT Act."
  4. Evidence Deletion: Your brother might delete the screenshots he took or the logs of him accessing your account.

    • Workaround: Check your "Login Activity" on Instagram and WhatsApp Linked Devices immediately. Take a screenshot of any "Unknown Device" or a login time that wasn't you. This is your digital paper trail.

Templates / script

Script: The "Boundary Setting" Talk

Use this when you want to warn your brother/parents without going to the police yet. "I know you think looking through my phone is just 'keeping an eye on me,' but under the DPDP Act 2023 and the Supreme Court’s Puttaswamy judgment, I have a fundamental right to digital privacy. Accessing my private chats without consent is a breach of the IT Act. I am documenting this instance. If my private data is shared further or used to threaten me, I will be forced to file a formal grievance on the Cyber Crime portal to protect my digital identity. Let's respect each other's space so it doesn't have to become a legal issue."

Template: Formal Complaint to the Cyber Cell

If the snooping turns into blackmail or public shaming, use this text for your online report at cybercrime.gov.in.

Subject: Complaint regarding unauthorised access to personal data and violation of privacy.

Description: I am writing to report a violation of my digital privacy. On [Date], my personal mobile device was accessed without my consent by [Name/Relationship].

  1. The individual accessed private conversations on [App Name, e.g., Instagram/WhatsApp].
  2. Private data was extracted via screenshots/forwarding without my authorisation.
  3. This data is now being used for [mention if it's blackmail, harassment, or shaming].

This constitutes a violation of Section 66E of the Information Technology Act, 2000 (violation of privacy) and is a breach of my fundamental right to privacy as upheld by the Supreme Court of India. I request you to take note of this incident and provide acknowledgment of this complaint.

Evidence Attached: [List screenshots of login activity or threats made using the stolen data].

Template: RTI to check Police Action

If you filed a local complaint and the police are ignoring you, file an RTI under Section 6(1) of the RTI Act 2005.

To: The Public Information Officer, [Name of Police Station/District Office] Subject: Seeking information regarding Complaint No: [Your Complaint Number] dated [Date].

Information Required:

  1. Please provide the current status of the investigation for the mentioned complaint.
  2. Please provide a copy of the Daily Diary (DD) entry or FIR registered in this matter.
  3. If no action has been taken, please provide the name and designation of the officer responsible for the delay as per the Citizen's Charter.

FAQs

1. Can my parents legally demand my passwords if I am under 18? Under the DPDP Act 2023, for minors, "lawful guardians" can give consent for data processing. However, the Justice K.S. Puttaswamy judgment still applies to you as an individual. While parents have a duty of care, it doesn't give them a blanket right to humiliate or blackmail you using your data. If the snooping leads to mental harassment, you can seek help from the Childline (1098).

2. Is it really a "crime" if my brother just showed my chats to my mom? Technically, yes. Under Section 72 of the IT Act, if someone accesses electronic records without your permission and discloses them, they can be penalised. While the police rarely arrest family members for this, having the law on your side gives you the leverage to stop the behaviour.

3. What if my brother threatens to post my private chats online? This is a serious offence. Under Section 351 of the BNS (Criminal Intimidation) and Section 66E of the IT Act, this is punishable with jail time and fines. If he threatens this, do not delete his messages. Screenshot them immediately and report it to the National Cyber Crime Reporting Portal.

4. How much does it cost to file a privacy complaint? Filing a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) is completely free. If you go to a police station to file an FIR, there is no fee. If anyone asks for money to "register" your case, they are asking for a bribe.

5. What should I do if the police refuse to file an FIR? If the police refuse to register your complaint about data theft or harassment, cite the Lalita Kumari v. Govt. of UP (2014) judgment. The Supreme Court ruled that police MUST register an FIR if the complaint discloses a cognizable offence. You can also send your complaint via registered post to the Superintendent of Police (SP) under Section 173(8) of the BNSS.

6. Will my brother go to jail if I report him? In most family-related digital privacy cases, the police first try "counselling" or a warning. Unless there is serious blackmail, extortion, or morphing of photos involved, immediate jail is unlikely. The goal of reporting is usually to create a legal record that stops the harassment.

7. Can I use the DPDP Act to sue my family for money? The DPDP Act 2023 allows for "compensation" in some cases, but it is primarily designed to regulate "Data Fiduciaries" (companies/entities). For family disputes, you are more likely to find relief under the IT Act (for the breach) and the BNS (for the threats/intimidation).

Frequently Asked Questions

1. Can my parents legally demand my passwords if I am under 18?

Under the DPDP Act 2023, for minors, "lawful guardians" can give consent for data processing. However, the *Justice K.S. Puttaswamy* judgment still applies to you as an individual. While parents have a duty of care, it doesn't give them a blanket right to humiliate or blackmail you using your data. If the snooping leads to mental harassment, you can seek help from the Childline (1098).

2. Is it really a "crime" if my brother just showed my chats to my mom?

Technically, yes. Under Section 72 of the IT Act, if someone accesses electronic records without your permission and discloses them, they can be penalised. While the police rarely arrest family members for this, having the law on your side gives you the leverage to stop the behaviour.

3. What if my brother threatens to post my private chats online?

This is a serious offence. Under Section 351 of the BNS (Criminal Intimidation) and Section 66E of the IT Act, this is punishable with jail time and fines. If he threatens this, do not delete his messages. Screenshot them immediately and report it to the National Cyber Crime Reporting Portal.

4. How much does it cost to file a privacy complaint?

Filing a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) is completely free. If you go to a police station to file an FIR, there is no fee. If anyone asks for money to "register" your case, they are asking for a bribe.

5. What should I do if the police refuse to file an FIR?

If the police refuse to register your complaint about data theft or harassment, cite the *Lalita Kumari v. Govt. of UP (2014)* judgment. The Supreme Court ruled that police MUST register an FIR if the complaint discloses a cognizable offence. You can also send your complaint via registered post to the Superintendent of Police (SP) under Section 173(8) of the BNSS.

6. Will my brother go to jail if I report him?

In most family-related digital privacy cases, the police first try "counselling" or a warning. Unless there is serious blackmail, extortion, or morphing of photos involved, immediate jail is unlikely. The goal of reporting is usually to create a legal record that stops the harassment.

📮

One civic-action playbook a week

RTI templates, FIR scripts, real escalation ladders — the same kind of thing you just read. Sundays only. No spam.

We don't share your email. Unsubscribe any time.

How to protect your digital privacy from family in India · HowToHelp