Digital Personal Data Protection - The Role Of Government In Data Protection

Author: LawSphereX

Category: Technology, Cyber & Privacy

Published: 2026-08-23T19:20:55.379Z

Updated: 2026-08-30T07:10:11.449Z

DIGITAL PERSONAL DATA PROTECTION: THE ROLE OF

GOVERNMENT IN DATA PROTECTION Tushar Tiwari, Uttaranchal University, Law College Dehradun Dr. Bhawna Arora, Associate Professor, Law College Dehradun Introduction India, one of the world's largest digital economies, operated without a dedicated data protection framework until 2023. The Digital Personal Data Protection Act 2023 changed this by establishing the country's first complete regime that safeguards personal data in the digital realm. The landmark legislation emerged after more than five years of discussions and marked a major development in India's data protection laws. It takes inspiration from global data privacy laws like GDPR and introduces substantial compliance measures. Organizations face penalties up to INR 250 Crores for serious violations.

The complete framework protects people's digital personal data and sets clear guidelines for its collection, processing, and storage. This piece explores how the government shaped India's data protection scene. We'll look at the Act's main provisions, enforcement mechanisms, and what it means for citizens and organizations that process personal data. Evolution of Data Protection Laws in India India's data protection story shows how judicial decisions, laws, and expert recommendations have shaped today's framework. This progress reflects how the nation increasingly values digital privacy rights in our data-driven world. The Justice K. S. Puttaswamy Judgment (2017): Privacy Becomes a Fundamental Right A defining moment in India's data protection scene arrived on August 24, 2017.

A nine-judge bench of the Supreme Court unanimously recognized privacy as a fundamental right in the landmark Justice K. S. Puttaswamy v. Union of India case [1]. This historic verdict proved that the right to privacy exists under Articles 14, 19, and 21 of India's Constitution as an essential part of the right to life and personal liberty [1].

The judgment came through six separate concurring opinions and created the constitutional foundation for data protection legislation in India. Justice Chandrachud's majority opinion stressed that privacy includes informational privacy, which protects personal data from unauthorized use or access [2]. The Court also made it clear that while privacy remains fundamental, it isn't absolute and laws can restrict it for legitimate state interests [2]. From IT Act 2000 to DPDP Act 2023: The Legislative Path India's early approach to data protection lacked cohesion. The Information Technology Act,

2000 (IT Act) served as the main legislation that addressed data privacy concerns related to

cybercrimes and electronic commerce [3]. The Information Technology Rules of 2011 later provided guidelines to protect sensitive personal information better [4]. These regulations had major limitations. The Rules only applied to organizations involved in commercial or professional activities. They left out government entities and only covered electronically collected data [4]. After the Puttaswamy judgment, the government began creating detailed data protection legislation. This process went through several stages:

1. A committee of experts prepared the first draft and asked for public feedback in 2018[5]

2. Parliament received the Personal Data Protection Bill, 2019 for review by a

parliamentary committee [5]

3. The government withdrew this bill and released a fresh draft in November 2022—the

draft Digital Personal Data Protection Bill, 2022 [5]

4. The Digital Personal Data Protection Act finally received presidential approval on

August 11, 2023, after both houses of Parliament passed it [6] Justice Sri Krishna Committee's Role in Creating the Data Privacy Framework The Justice B.N. Srikrishna Committee, formed in 2017, created India's modern data protection framework [7]. This nine-member Committee of Experts on Data Protection published a white paper and asked for public comments on 231 data protection questions [8].

The committee submitted its report with a draft Personal Data Protection Bill to the Ministry of Electronics and Information Technology on July 27, 2018 [8]. The report set several key principles: • Personal data means information that can identify an individual directly or indirectly [9] • Service providers processing data must maintain a fiduciary relationship with individuals [9] • Processing personal data requires consent, with extra protections for sensitive data [9] • Individual rights must follow principles of autonomy, self-determination, transparency, and accountability [9] • An independent Data Protection Authority should regulate these matters [9] These recommendations shaped later versions of the data protection bill. The final DPDP Act of 2023 changed many provisions compared to the 2018 draft [5].

Government as the Architect of Data Protection Framework India's government has taken charge as the architect of the nation's data protection framework with the Digital Personal Data Protection Act 2023 (DPDP Act). The legislation came into effect on August 11, 2023. It represents the final version after five different proposed bills and replaces the previous regulations under Section 43A of the Information Technology Act, 2000 [10]. Key Provisions of the Digital Personal Data Protection Act 2023 The DPDP Act sets up several fundamental concepts that shape India's approach to data protection: Let's take a closer look at how it establishes a fiduciary relationship between individuals (data principals) and entities that process their data (data fiduciaries) [10]. This relationship creates specific duties for organizations that handle personal information.

The Act gives data principals important rights over their information, including:

Access to summaries of collected data • Knowledge about other entities that share their data • Data erasure when they withdraw consent • Ability to appoint digital nominees [11] Data fiduciaries must meet vital obligations such as: • Keeping adequate security safeguards • Making sure data stays accurate and complete • Telling the Data Protection Board about breaches • Having data protection officers • Setting up ways to handle complaints [11] The Act stands out because it doesn't have sub-categories of personal data. This is different from the old SPDI Rules that separated personal information from sensitive personal data [10]. Scope and Applicability: Digital Personal Data Within and Beyond Borders The DPDP Act's reach is clear yet extensive.

It covers: • Digital personal data collected online in India • Physical data that becomes digital • Processing done outside India if it connects to offering goods or services to people in India [12] Organizations outside India must follow the Act even without regular contact with Indian data principals. Even collecting data once could mean they need to comply [10]. The law also applies to any data processing that connects to Indian residents, whatever the location [11]. The Act doesn't apply to:

Processing of anonymized data • Personal or domestic processing by individuals • Personal data that's already public [10] Legitimate Uses vs. Consent-Based Processing The DPDP Act has two main ways to process personal data: consent and legitimate uses. Consent-based processing needs: • Free, specific, informed consent • Clear approval from the data principal •

A detailed notice about why data is processed

The right to take back consent anytime [11] Legitimate uses allow processing without direct consent in specific cases:

1. When people willingly give data for specific purposes

2. Government services with prior consent for similar services

3. Medical emergencies or public health threats

4. National security or public order needs

5. Following legal obligations or court orders [1]

India's legitimate uses are more limited than the European GDPR's "legitimate interest" concept. The Act lists only eight specific situations [1]. "Vicarious consent" - where someone consents for another person - creates challenges, especially when employers need emergency contact details [1]. This framework tries to balance practical needs with privacy protection, especially when getting consent isn't practical or possible.

Data Protection Board: Government's Regulatory Arm The Data Protection Board (DPB) stands at the core of India's data protection enforcement system. This 2023 old corporate body works as the government's regulatory arm under Section

18 of the Digital Personal Data Protection Act 2023. The government has given it extensive

powers to enforce the new data protection regime. Structure and Appointment Process The Central Government decides the Board's composition, which includes a Chairperson and several members. Section 19 of the Act lets the government appoint these members through a defined selection process. Board members need expertise in data governance, administration, information technology, law, or regulation, along with proven "ability, integrity and standing. " The Board must have at least one member with legal expertise to ensure proper judgment. Members can serve for two years and qualify for reappointment. The Act lists specific grounds for disqualification such as insolvency, criminal conviction, physical or mental incapacity, conflict of interest, or position abuse.

The Board's integrity remains protected as former members must wait one year before working with any data fiduciary they once supervised. Powers to Investigate and Impose Penalties The Board runs as a digital office and conducts most proceedings online to match its data regulation role. It holds civil court-like investigative powers that include: • Summoning witnesses and examining them under oath • Requiring document production and inspection • Breaking down data breaches and non-compliance The DPB can levy heavy penalties—up to ₹250 crore per violation—for breaking the Act's provisions. Before starting an inquiry, the Board must find valid grounds and document its reasoning in writing. Natural justice principles guide all proceedings. The Board's powers extend beyond penalties.

It can order urgent fixes after data breaches, accept voluntary commitments from non-compliant entities, and suggest alternative dispute resolution. Comparison with Previously Proposed Data Protection Authority The current DPB has a much smaller scope than the previously proposed Data Protection Authority (DPA). The DPA was meant to be a complete regulatory body that could create regulations and codes of conduct. The DPB focuses on preventing breaches, fixing issues, and imposing penalties. The Board cannot match the DPA's proposed supervisory powers to request information or monitor business practices actively. This shows a fundamental change from proactive regulation to reactive enforcement. Critics point out design flaws in the Board's structure, such as minimal separation between inquiry and judgment functions.

Though meant to be independent, the government-appointed structure raises questions about the Board's freedom to enforce data protection standards, especially when government entities act as data fiduciaries. Government Exemptions Under Data Privacy Laws in India The Digital Personal Data Protection Act 2023 has major carve-outs for government agencies. This creates a regulatory framework where state interests might override individual privacy rights. These exemptions have started debates about balancing national security with data protection. National Security and Public Order Exemptions Section 17(2)(a) of the DPDP Act lets the Central Government exempt "any instrumentality of the State" from all provisions of the Act. The exemptions apply when sovereignty, security, foreign relations, public order, or prevention of cognizable offenses are involved [2].

Yes, it is a broad exemption that allows designated agencies to process citizens' personal data. They can do this without following consent requirements, purpose limitations, or other safeguards that are 2023 old [11]. Union Minister for Electronics and IT, Ashwini Vaishnaw, says the government will add "detailed safeguards" in upcoming rules while implementing these exemptions [13]. He defended these provisions by pointing out that much of the language comes from constitutional provisions about reasonable restrictions on freedom of speech and expression [13]. Legal Analysis of Section 17(2)(a) Provisions Legal experts have raised concerns about these broad exemptions, despite government assurances. The term "instrumentality of the State" remains undefined in the Act. This could include any entity that performs state functions or operates under government control [14].

Section 17(2) exemptions seem redundant because Section 17(1)(c) already waives requirements for "prevention, detection, investigation or prosecution of any offense" [2]. This redundancy hints at a planned complete exclusion from data protection norms for certain government activities [2]. Government agencies can keep personal data forever under the Act. This applies even if the original purpose no longer exists. Citizens have no right to ask for data erasure [14]. Balancing State Functions with Privacy Rights: The Aadhaar Case Study The Supreme Court's Aadhaar judgment shows how to balance state functions with privacy rights. The Court upheld Aadhaar's constitutionality while setting limits on surveillance by:

1. Striking down Section 33(2) of the Aadhaar Act that allowed information disclosure for

national security [15]

2. Limiting authentication metadata storage to six months instead of five years [6]

3 Creating a three-part test for privacy invasions

legality, necessity, and proportionality [3] The Court stressed that state intervention must be "reasonable, justifiable, and proportionate" [3]. The DPDP Act's exemptions are broader than what the Court saw as appropriate limits on privacy rights. This creates potential tension between what lawmakers want and what judges have decided.

Legal Obligations of Government as a Data Fiduciary Government institutions face a unique challenge under the Digital Personal Data Protection Act 2023. They must create regulations and comply with specific legal obligations while handling citizens' personal data. Security Safeguards for Government-Held Data Government bodies need resilient security measures to protect personal information. CERT-In provides specific advisories to ministries about cybersecurity requirements for entities that handle digital personal data [16].

These safeguards must: • Protect data through encryption, obfuscation, masking, or virtual tokens • Keep logs and personal data for one year to detect unauthorized access • Ensure personal data remains accurate, complete, and consistent The Indian Cyber Crime Coordination Center (I4C) and National Cyber Crime Reporting Portal help law enforcement agencies respond better to cybercrimes [16]. Government departments must create security policies based on internal and external audits of their ICT infrastructure. Cross-Departmental Data Sharing: Legal Framework Each government department currently works in isolation. They collect and protect personal identifiable information based on their specific operational needs [17]. The National Data Sharing and Accessibility Policy (NDSAP) from 2012 wants to make non-sensitive data more accessible to registered users [18].

The current system doesn't deal very well with inter-agency collaboration. Departments often need formal requests that take too much time and prove inefficient [17]. Zero Knowledge Proof (ZKP) mechanisms offer a solution to these challenges. These mechanisms let one department verify information without seeing the actual data. Personal data goes through one-way irreversible anonymization to keep sensitive information safe [17].

Grievance Redressal Mechanisms for Citizens The DPDP Act requires government data fiduciaries to set up grievance redressal mechanisms that are accessible to more people. Citizens can report violations related to their personal data [9]. The system must: • Give clear contact information for grievance officers • Let data principals correct, complete, or erase their data • Set up processes to handle complaints before they reach the Data Protection Board The Data Protection Board works through a digital office approach. Citizens can submit complaints without going to a physical office [19]. The system's success depends on implementation. Similar mechanisms in other sectors haven't worked well because of unresponsive systems [8]. Government data fiduciaries must balance these obligations with their other functions to protect privacy while maintaining administrative efficiency.

Conclusion India's data protection journey has reached a new phase with the Digital Personal Data Protection Act 2023. The country has moved from simple IT Act provisions to a complete privacy framework. The landmark Puttaswamy judgment sparked this development and shows India's dedication to protecting citizens' digital rights while managing national security interests. A structured enforcement system comes through the Data Protection Board that can impose penalties up to ₹250 crores. The Board's establishment is a vital step toward standardized protection practices in public and private sectors, though questions about its independence remain. Privacy protection faces challenges from government exemptions under Section 17(2)(a).

The Supreme Court's Aadhaar judgment provides direction by emphasizing that state interventions should pass the three-part test of legality, necessity, and proportionality. These guidelines should shape how government exemptions are interpreted under the DPDP Act. The data protection framework's success depends on balanced implementation. Government bodies need to act both as regulators and data fiduciaries. They must also ensure resilient security measures protect citizens' personal information. The Act's effectiveness in securing India's digital future will depend on how well it balances state functions with individual privacy rights.

References [1] - https://www. medianama. com/2023/11/223-consent-maze-legitimate-uses-indirectconsent-data-processing/ [2] - https://nyujilp. org/the-right-to-pry-vacy-understanding-indias-dystopian-data-protectionlegislation/ [3] - https://publications. vynolegal. com/the-right-to-privacy-and-the-aadhaar-verdictbalancing-individual-rights-and-state-surveillance [4] - https://irglobal. com/article/evolution-of-data-protection-law-in-india/ [5] - https://carnegieendowment. org/research/2023/10/understanding-indias-new-dataprotection-law? lang=en [6] - https://byjus. com/free-ias-prep/aadhaar-and-the-right-to-privacy/ [7] - https://www. manupatracademy. com/assets/pdf/legalpost/evolution-of-digital-personaldata-protection-law-in-india. pdf [8] - https://www. medianama. com/2023/11/223-data-protection-board-grievance-redressalprivacynama/ [9] - https://carnegieendowment.

org/research/2023/10/understanding-indias-new-dataprotection-law? center=india&lang=en [10] - https://www. azbpartners. com/bank/india-digital-personal-data-protection-act-2023part-one-scope-and-application/ [11] - https://carnegieendowment. org/research/2023/10/understanding-indias-new-dataprotection-law [12] - https://prsindia. org/billtrack/digital-personal-data-protection-bill-2023 [13] - https://indianexpress. com/article/business/economy/personal-data-law-safeguards-tobe-brought-when-exemptions-kick-in-8904557/ [14] - https://www. medianama. com/2023/08/223-dpdp-bill-2023-government-exemptions-3/ [15] - https://www. drishtiias. com/daily-news-analysis/supreme-court-upholds-aadhaarsconstitutional-validity [16] - https://pib. gov. in/PressReleasePage. aspx? PRID=2037115 [17] - https://www. financialexpress.

com/opinion/securing-privacy-of-data-shared-bygovt/3524383/ [18] - https://dst. gov. in/national-data-sharing-and-accessibility-policy-0 [19] - https://pib. gov. in/PressReleaseIframePage. aspx? PRID=2090271