Relevance: GS II – Governance; GS III – Science & Tech
Source: Government notifications, expert commentary

The News

The Union Government has notified major provisions of the Digital Personal Data Protection (DPDP) Act, 2023 along with the DPDP Rules, 2025, formally operationalising India’s new data governance framework. 

Some provisions related to public-authority data processing and the RTI framework have come into immediate effect.

Context: India’s Data Privacy Turning Point

The notification brings India closer to fulfilling the Supreme Court’s K.S. Puttaswamy (2017) judgment, which declared privacy a fundamental right. The DPDP Act aims to regulate the rapidly growing digital ecosystem—over 800 million internet users, rising fintech platforms, e-governance systems, and AI-based services—by defining how personal data is collected, processed, stored, and protected.

Key Provisions Now Coming Into Force

1. Institutional Framework

• Establishment of the Data Protection Board of India for adjudicating breaches, imposing penalties, and issuing directions.
  
• Rules for breach notification, grievance redress, and preliminary compliance standards.
  

2. Phased Implementation

Core Concepts

• Data Principal: The individual whose personal data is processed.
  
• Data Fiduciary: Any entity determining the purpose and means of processing.
  
• Consent Manager: A certified intermediary enabling secure, verifiable consent.
  
• Purpose Limitation: Data must be collected only for a lawful, specific purpose.
  
• Breach Notification: Mandatory reporting of data leaks to users and the Board.
  

Governance Perspective: Why This Matters for India

Opportunities

• Citizen Empowerment: Clear rights to access, correct, erase, or port personal data.
  
• Global Alignment: Moves India closer to the EU GDPR-style frameworks, boosting digital trade compatibility.
  
• Stronger Digital Economy: Creates trust for digital payments, health platforms, EdTech, and AI innovation.
  

Concerns

• State Exemptions: Broad powers for government processing of personal data may dilute checks and safeguards.
  
• RTI Dilution: Amendments remove mandatory disclosure of officials’ personal information even when public interest is high, raising transparency concerns.
  
• Capacity Gaps: Sector regulators, small firms, and startups may struggle to meet technical and legal compliance demands.
  
• Enforcement Dependence: The effectiveness hinges on how independent, well-staffed, and technically capable the Data Protection Board becomes.

The DPDP framework attempts to strike a balance between user rights, administrative efficiency, and industry needs. However, the real test lies in execution—especially ensuring transparent state use of data, avoiding over-centralisation, and protecting vulnerable populations who may not fully understand or exercise digital rights.

One-Line Wrap

India’s data protection regime marks a historic shift—promising stronger privacy protections while reopening debates on state power and transparency.

UPSC Mains Question

“Critically examine whether the Digital Personal Data Protection Act, 2023 strikes an appropriate balance between privacy, governance efficiency and digital-economy growth.”