#Police Signal Jammers in India: The Privacy Harm the DPDP Act Cannot Touch

On 16 September the Internet Freedom Foundation published three Right to Information applications it had filed with the Delhi Police, asking a question nobody in Indian law has a clean answer to: under what authority does a police force switch off everybody's phone in a city block? The honest answer, as far as the statute book goes, is none — and the DPDP Act 2023, India's flagship privacy law, is structurally incapable of supplying one.

That gap matters more than it sounds. Indian businesses are eighteen months into a compliance countdown where a mis-worded consent notice can eventually draw a penalty of up to ₹250 crore. Meanwhile the most total interference with a citizen's digital life available to the Indian state — cutting off every call, message and data session inside a radius, indiscriminately, with no order, no record and no notice — falls outside that law entirely. Understanding why is a useful lesson in what India's privacy regime actually is, and what it deliberately is not.

#What IFF Filed, and What Triggered It

The three RTI applications went to the Delhi Police on 8 September 2026. They ask for three distinct things.

The first (Reg. DEPOL/R/E/26/10072) seeks the institutional picture: every jamming device the force holds, the procurement contracts behind them, the permissions obtained, the standard operating procedures governing deployment, and usage statistics since 2023.

The second (Reg. DEPOL/R/E/26/10074) is incident-specific. It asks for any record of jamming around Jantar Mantar between 20 June and 25 July 2026 — activation times, the officers who authorised it, and the correspondence with other authorities.

The third (Reg. DEPOL/R/E/26/10077) asks the Delhi Police to produce the records supporting its own public claim, made on 8 September, that no jammers were used at the Satya Niketan rescue site.

Both incidents are worth taking seriously on their own terms.

During the 'Chalo Sansad' march on the opening day of the monsoon session, mobile networks around Jantar Mantar went down. The Ministry of Home Affairs did issue suspension orders — six of them, covering data only, invoking Section 20(2)(b) of the Telecommunications Act, 2023 read with the Telecommunications (Temporary Suspension of Services) Rules, 2024. But voice calls and SMS were also reported blocked, which those orders did not authorise. Press reports attributed the additional blackout to police jamming equipment. At the time, as IFF noted in its 20 July statement, no copy of any suspension order had been published by the MHA, the Department of Telecommunications, the Delhi government or the police. The shutdown around Jantar Mantar ultimately ran across multiple days into late July.

The Satya Niketan case is starker. On 6 September a five-storey building operating as a boys' paying-guest accommodation collapsed in south-west Delhi, killing at least seven people. Residents near the site reported that mobile data slowed to the point where basic WhatsApp messages went through but photographs, video and live updates would not upload. Allegations followed — amplified politically — that jammers had been deployed to keep footage of the rescue operation off the internet. The Delhi Police flatly denied it, saying networks were fully operational and emergency agencies were communicating without disruption. There is a mundane alternative explanation — narrow, crowded lanes and a sudden crowd of onlookers will degrade a cell site's throughput on their own — and it may well be the right one. IFF's RTI does not assume otherwise. It simply asks the force to show the records behind its denial.

#The Legal Hole: Section 48 and a Cabinet Secretariat Circular

Here is what actually governs jamming in India.

Section 48 of the Telecommunications Act, 2023 — notified into force on 5 July 2024 — says no person shall possess or use equipment that blocks telecommunication unless permitted by the Central Government. That is a possession-and-authorisation rule. It tells you who may own a jammer. It says nothing about when a jammer may be switched on, for how long, over what radius, on whose written order, with what record, or with what remedy for the people inside the blast radius.

The operational layer is not a statute at all. It is a set of Cabinet Secretariat guidelines issued by the Secretary (Security), which restrict procurement to central ministries, state governments, defence and central armed forces and a handful of other bodies, and which contemplate deployment for VVIP security against radio-controlled explosive devices and for examination halls. Crowd control at a protest is not on that list. Neither is a building collapse.

So the authorisation framework covers buying the device for one narrow class of purposes, and a policy circular — not law — gestures at what those purposes are. There is no statutory framework for the act of jamming itself.

Compare that to internet shutdowns, which are far from well-governed but at least have a skeleton. A suspension under Section 20(2)(b) and the 2024 Rules requires a written order from a competent authority, confinement to a defined geographical area that is the minimum necessary, a stated duration, and review by a committee. Layered on top is Anuradha Bhasin v. Union of India, in which the Supreme Court held that suspension orders cannot be indefinite, must satisfy legality, necessity and proportionality, and must be published so they can be challenged. The compliance record against those standards is genuinely poor — district-wide blackouts justified by boilerplate about "anti-national elements" are routine, and the Delhi orders in July were not published contemporaneously. But a poor record against a standard is a different problem from having no standard.

This is IFF's central analytical point, and it is correct: a shutdown is a legal instrument aimed at a service, executed through licensees, with paperwork that can in principle be obtained and litigated. Jamming is a physical act — a radio transmitter drowning out a band — that leaves no order, no licensee in the loop, and no document to file an RTI against unless the force chooses to create one. It is the same interference with the same right, achieved in a way that routes around every safeguard the shutdown framework provides. IFF's four asks follow directly: a Cabinet Secretariat clarification that the jammer guidelines exclude protest management; an amendment to the suspension rules expressly barring jamming as a workaround; an interim requirement of written authorisation with a defined radius, duration and hospital notification; and eventually, primary legislation.

#Why the DPDP Act Has Nothing to Say

An obvious question for anyone tracking India's privacy law: isn't this what the DPDP Act is for?

No — and the reasons are worth being precise about, because they define the shape of the regime Indian businesses are now building against.

First, the DPDP Act regulates processing, not interference. Its entire operative structure — notice, consent, purpose limitation, retention, erasure, breach notification, data principal rights — attaches to a Data Fiduciary that determines the purpose and means of processing personal data. Jamming does not process anybody's personal data. It destroys the ability to communicate. That is an Article 19(1)(a) and Article 21 harm, and under Puttaswamy it is squarely a privacy harm, but it is not a data-protection harm in the sense the statute uses. There is no fiduciary, no data principal, no processing activity, and therefore no hook.

Second, even if there were a hook, Section 17(2)(a) would likely remove it. That provision lets the Central Government exempt any instrumentality of the State from all or any provisions of the Act by gazette notification, on grounds including sovereignty, integrity, security of the State, public order and preventing incitement to offences. No parliamentary approval is required. No proportionality test is written in. No sunset, no mandatory publication of the reasoning, no independent authorisation. A police force managing a protest sits comfortably inside "maintenance of public order." The Act's critics have made this argument since 2023; the jammer question is simply a vivid illustration of it.

Third, the DPDP Act contained no surveillance reform at all. The Justice Srikrishna committee framing, and the 2018 and 2019 drafts, treated state access to personal data as part of the problem to be solved. What was eventually enacted does not. There is no warrant requirement, no judicial oversight of state data access, no transparency reporting obligation on government, nothing. The Act asks private companies to justify their data practices to a regulator and leaves the state's practices where they were.

The result is an accountability asymmetry that will become much more visible over the next eight months. From 13 November 2026, Consent Manager registration opens and the Data Protection Board can inquire into and penalise breaches in that layer. By 13 May 2027, the substantive obligations — notice, consent, data principal rights, retention limits, cross-border rules, breach reporting — bind every Data Fiduciary in the country, with penalties running to ₹250 crore. A startup that keeps a customer's phone number three months longer than its stated retention period will have a regulator to answer to. A police unit that switches off every phone within 300 metres of a protest, with no order and no log, will not.

#What This Means in Practice

For citizens, the practical takeaway is that your recourse depends entirely on which mechanism was used against you. If mobile data went down because of a suspension order, that order is in principle obtainable, reviewable and challengeable, and Anuradha Bhasin gives you a proportionality argument. If it went down because of a jammer, you have no order to challenge, and establishing that jamming even occurred is itself the hard part — which is precisely why IFF went the RTI route rather than straight to court. Note also the safety dimension, which is not rhetorical: indiscriminate jamming inside a perimeter blocks emergency calls, and at Jantar Mantar that perimeter contained hospitals.

For Indian businesses, particularly telecom operators, ISPs and any service with a real-time dependency, this is an operational risk with no contractual counterparty. Your service can be degraded to zero in a defined area by an act that generates no order you can point a customer to, no SLA carve-out you can invoke, and no record you can obtain. Payment terminals, ride-hailing, delivery, telemedicine and emergency response all fail inside a jammed radius. If you are mapping availability risk for a DPIA or a board-level resilience review, "extra-legal radio interference by a state actor" belongs on the register — and unlike a shutdown, it currently has no notification path. Our /resources library tracks how the Telecom Act's suspension machinery interacts with the DPDP Rules for exactly this kind of overlap.

For policy watchers, the jammer question is a clean test of whether India's privacy settlement is about data governance or about privacy. The DPDP Act, its Rules, the Board and the Consent Manager framework together constitute a serious, if consent-heavy, data-governance regime for the private sector. They constitute almost nothing for the state. Whether that second half ever gets written is the open question, and the five-judge Constitution Bench hearing the challenge to Section 44(3) is one of the few places it might be forced.

#The Bottom Line

The DPDP Act is not failing here. It is doing exactly what it was drafted to do, which is to govern how organisations handle personal data. The problem is that Indian public discourse has increasingly treated the DPDP Act as the privacy law — and on the evidence of Delhi's jammers, it is not even the relevant one. Communications blackouts are governed by a possession rule in the Telecom Act and a procurement circular from the Cabinet Secretariat, with a body of shutdown jurisprudence that jamming conveniently sidesteps.

The Delhi Police now have thirty days to respond to IFF's applications. Whether they produce the deployment logs, the SOPs and the authorisations — or decline under one of the RTI Act's exemptions — will tell us a good deal about whether any record exists to produce. Watch this space, and if you are building your DPDP compliance programme on the assumption that the Act covers the full surface of Indian privacy law, revisit that assumption now rather than in May 2027.

---

DPDPBot tracks DPDP Act implementation, the DPDP Rules 2025 timeline and the wider Indian privacy landscape daily. Explore our /resources library for compliance guidance, or see the /consent-manager briefing ahead of the 13 November 2026 registration window.