Digital technology now mediates communication, work, education, commerce, payments and public services, and almost every such activity generates personal data. Individually these fragments appear ordinary, but their aggregation permits detailed profiling, which has turned digital privacy from a question of unauthorised access into one of lawful collection, purpose limitation, retention, automated inference and State access. This article asks whether the Indian statutory framework delivers the standard of informational privacy that the Constitution requires, when most of its substantive obligations remain unenforced and its regulator remains unconstituted. The study is doctrinal, analysing the Constitution, the Digital Personal Data Protection Act, 2023 and the Rules of 2025, the Information Technology Act, 2000, the Telecommunications Act, 2023 and the decisions of the Supreme Court and the High Courts against the General Data Protection Regulation and the European Union Artificial Intelligence Act. The Act builds a coherent architecture of notice, consent, data principal rights, fiduciary duties and graded penalties, but four features weaken it: staged commencement defers the operative obligations to May 2027, so the compensation regime under the Information Technology Act governs until then; the exclusion of publicly available personal data leaves the training of artificial intelligence systems largely outside the Act; the exemption power for State instrumentalities and the power to call for information face constitutional challenge; and the Data Protection Board has no appointed members. The article recommends that Parliament narrow the exemption power, confer a right against solely automated decision-making, and insulate appointments to the Board from executive control.