1. Introduction

Proportionality in control design is the principle that an organisation's internal controls, monitoring systems, compliance procedures, security restrictions, and disciplinary measures should be appropriate to the risks they are intended to address.

The principle requires organisations to balance legitimate objectives—such as preventing fraud, protecting confidential information, ensuring regulatory compliance, and maintaining workplace discipline—against the impact of those controls on individual rights, operational efficiency, privacy, and fairness.

For example, an organisation investigating unauthorised access to confidential employee records may reasonably introduce access restrictions, audit logging, and targeted monitoring. However, continuously recording every employee's screen, private communications, and personal activities may be excessive if less intrusive controls would adequately address the risk.

Proportionality does not mean that every control must be minimal or that stringent controls are always unlawful. A high-risk environment may justify extensive safeguards. The central requirement is that the control should be justified by the seriousness and likelihood of the risk, its effectiveness, and the availability of less restrictive alternatives.

In India, proportionality is particularly important in constitutional law, privacy protection, administrative decisions, and public-sector regulation. In private employment and corporate governance, it may inform the interpretation of applicable statutes, contractual duties, data-protection obligations, and fair decision-making practices.

2. Meaning and scope of proportionality in control design

Proportionality in control design means matching the intensity, scope, duration, and consequences of a control to the objective it seeks to achieve.

It applies to several areas:

Information security: Selecting authentication, access restrictions, logging, and monitoring measures according to system risk.

Employee monitoring: Limiting surveillance to legitimate workplace purposes and avoiding unnecessary collection of personal information.

Fraud prevention: Applying stronger verification to high-risk transactions rather than imposing excessive restrictions on every routine activity.

Human resources: Ensuring that performance management and disciplinary measures reflect the seriousness of established conduct.

Data protection: Collecting and retaining only the information reasonably necessary for a defined purpose.

Regulatory compliance: Designing controls that satisfy legal requirements without creating unnecessary operational burdens.

Automated decision-making: Ensuring that risk scores and automated alerts do not trigger severe consequences without appropriate validation and review.

A control may be excessive because it collects too much information, applies to too many people, continues for too long, restricts legitimate activity unnecessarily, or imposes consequences disproportionate to the underlying conduct.

3. The main tests of proportionality

A structured proportionality assessment commonly considers four questions.

1. Legitimate objective

Is the control intended to achieve a lawful and legitimate purpose, such as preventing data theft, protecting customers, or meeting a legal obligation?

2. Suitability

Is the control reasonably capable of achieving that objective? A measure that creates administrative burdens without reducing the relevant risk may not be justified.

3. Necessity

Is there a less restrictive, reasonably effective alternative? For example, role-based access restrictions may address an information-security risk without requiring continuous employee surveillance.

4. Overall balancing

Do the benefits of the control justify its impact on privacy, employee rights, operational efficiency, and other affected interests?

These questions are particularly associated with constitutional proportionality analysis. The exact test and its application vary according to the governing law and the type of decision being challenged.

4. Important case laws on proportionality in control design

Case 1: Modern Dental College and Research Centre v. State of Madhya Pradesh (2016) 7 SCC 353

Legal principle: Structured proportionality test.

The Supreme Court considered regulatory restrictions affecting admissions and fees in private professional educational institutions. In examining restrictions on constitutional freedoms, the Court discussed proportionality and the relationship between regulatory measures and legitimate objectives.

The framework includes a proper purpose, rational connection between the measure and that purpose, necessity in the sense of considering less restrictive alternatives, and balancing the competing interests.

Relevance to control design: Organisations can use this framework when assessing whether a proposed control is justified. For example, before introducing extensive monitoring software, an organisation should identify the risk, establish how monitoring will reduce it, consider less intrusive alternatives, and evaluate the effects on employees.

The case arose in a constitutional and regulatory setting; the four-part framework should not be treated as a universally mandatory test for every private-sector policy.

Case 2: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Legal principle: Privacy, necessity, and proportionality.

A nine-judge Constitution Bench recognised privacy as a fundamental right under the Indian Constitution. The judgment addressed informational privacy, dignity, autonomy, and the need to justify intrusions into protected interests.

Relevance to control design: Privacy-invasive controls require careful consideration of their purpose, legal basis, scope, and safeguards, especially where a public authority is involved.

For example, collecting employee login records may be justified for cybersecurity, while continuously recording private communications could be excessive if the same objective can be achieved through less intrusive security logs.

The constitutional framework directly governs State action. Private organisations must additionally consider the applicable statutory and contractual requirements.

Case 3: Maneka Gandhi v. Union of India (1978) 1 SCC 248

Legal principle: Fairness, non-arbitrariness, and just, fair, and reasonable procedure.

The Supreme Court considered restrictions imposed on an individual's passport and developed important principles concerning Article 21 of the Constitution. The judgment emphasised that procedures affecting protected interests must meet constitutional standards of fairness and reasonableness.

Relevance to control design: Where an organisation's decision engages applicable legal protections, controls should not operate arbitrarily. Rules governing investigations, access restrictions, or disciplinary action should have a legitimate basis and be implemented through a fair process.

In public administration, this principle is particularly significant. In private employment, its direct constitutional application differs, although similar fairness concerns may arise under employment law, contracts, and applicable statutory obligations.

Case 4: Om Kumar v. Union of India (2001) 2 SCC 386

Legal principle: Proportionality in administrative action and judicial review.

The Supreme Court examined the relationship between proportionality and administrative decision-making. It discussed how courts assess administrative measures and disciplinary decisions, distinguishing proportionality review from the traditional Wednesbury approach to unreasonableness in the relevant legal context.

Relevance to control design: Public authorities should ensure that restrictive administrative controls and sanctions are justified by the purpose pursued. The intensity of judicial review depends on the nature of the decision and the applicable legal framework.

For organisational governance, the case supports a reasoned approach to controls rather than imposing the harshest available measure whenever a compliance issue arises.

Case 5: Anuradha Bhasin v. Union of India (2020) 3 SCC 637

Legal principle: Proportionality, necessity, and review of restrictive measures.

The Supreme Court considered restrictions on internet access and movement imposed in Jammu and Kashmir. It held that orders restricting internet services must be published, are subject to judicial review, and must satisfy applicable constitutional requirements. It also emphasised the need to consider proportionality and the duration of restrictions.

Relevance to control design: A restrictive measure should have a clear legal basis, a defined objective, a justified scope, and appropriate review. Its continuation should not be automatic when the circumstances that justified it have changed.

For example, a temporary suspension of an administrator account during a security incident may be reasonable, but indefinite suspension without reassessment may be excessive if the risk can be addressed through narrower restrictions.

Case 6: Ranjit Thakur v. Union of India (1987) 4 SCC 611

Legal principle: Disciplinary punishment must not be outrageously disproportionate.

The Supreme Court considered disciplinary punishment imposed on a member of the armed forces. It held that the punishment should not be so disproportionate to the misconduct that it shocks the conscience of the court.

Relevance to control design: An organisation should distinguish between a technical mistake, a minor policy violation, negligent conduct, and deliberate misconduct. The response should reflect the seriousness of the proven conduct, relevant circumstances, and applicable rules.

For example, an accidental access-control error may call for retraining and correction, whereas deliberate theft of confidential data may justify severe disciplinary or legal action.

Case 7: B.C. Chaturvedi v. Union of India (1995) 6 SCC 749

Legal principle: Judicial review of disciplinary punishment and the limits of intervention.

The Supreme Court considered the scope of judicial review in disciplinary proceedings involving a public servant. It explained that courts generally do not substitute their own assessment of punishment for that of the disciplinary authority, but may intervene in exceptional circumstances, including where punishment is shockingly disproportionate.

Relevance to control design: Organisations should establish a documented scale of consequences and apply it consistently. Decision-makers should consider the evidence, seriousness of the breach, the employee's role, and relevant mitigating or aggravating circumstances.

This case also cautions against assuming that every disagreement about the severity of a sanction will justify judicial intervention.

5. Practical application of proportionality in workplace controls

These are illustrative examples. The appropriate response depends on the facts, applicable legal requirements, and the seriousness of the risk.

6. A step-by-step proportionality assessment workflow

Identify the risk. Describe the specific harm the organisation wants to prevent, its likelihood, and its potential impact.

Define the objective. Establish the lawful business, security, or compliance purpose of the proposed control.

Assess effectiveness. Determine whether the measure will meaningfully reduce the identified risk and how its effectiveness will be measured.

Compare alternatives. Consider narrower permissions, targeted logging, additional approvals, staff training, or other less restrictive options.

Evaluate the impact. Examine effects on privacy, employee rights, operational continuity, accessibility, cost, and legitimate business activity.

Document the decision. Record the rationale, alternatives considered, legal review, safeguards, and approval.

Review and revise. Set review dates and reassess the control after incidents, changes in risk, or evidence that the measure is ineffective or excessive.

7. Governance and documentation requirements

A mature control-design framework should include:

Risk assessment: Evidence that the control addresses an identified risk rather than an undefined concern.

Legal review: Confirmation that the measure is consistent with applicable laws, contracts, and regulatory requirements.

Defined ownership: Identification of the person responsible for approving, operating, and reviewing the control.

Clear scope: Specification of who or what is covered, what activities are restricted, and how long the control remains active.

Exception handling: A documented method for dealing with emergencies and legitimate exceptions.

Human review: Appropriate review of consequential decisions based on alerts, automated scores, or suspected violations.

Auditability: Records explaining why the control was implemented, how it operated, and whether it achieved its intended purpose.

Periodic reassessment: A process for removing, reducing, or redesigning controls that are no longer necessary.

For automated systems, the organisation should also examine false positives, data quality, potential bias, and whether the system's output is being used beyond its originally intended purpose.

8. Conclusion

Proportionality in control design ensures that security, compliance, monitoring, and disciplinary measures remain connected to the risks they are intended to manage. It discourages arbitrary restrictions, unnecessary surveillance, excessive sanctions, and controls that impose substantial burdens without corresponding benefits.

The Supreme Court decisions discussed above provide important guidance on proportionality, privacy, administrative fairness, and disciplinary punishment. Their precise legal application differs between constitutional review, public administration, and private employment.

The central principle is that a control should be effective enough to address the identified risk, no more restrictive than reasonably necessary, and subject to safeguards and review appropriate to its impact.