What Should the State Know? Rethinking Government Data Power under the DPDP Act

This article examines government data power under the DPDP Act, focusing on State accountability, data minimisation, privacy, transparency, exemptions and institutional safeguards.

The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) has constituted a significant development in India’s legal framework to protect personal data and right to privacy. However, the provisions of the Act were not brought into force in its entirety immediately and was followed by the notification of Digital Personal Data Protection Rules, 2025 (DPDP Rules) on 13 November 2025, providing for a three-phased implementation. While provisions relating to the establishment of the Data Protection Board of India came into immediate effect, those relating to consent managers are yet to be implemented on 13 November 2026, with the substantive provisions under the Act and Rules coming into force 18 months from the date of notification, i.e., on 13 May 2027.¹ The phased implementation is intended to provide data fiduciaries sufficient time to set their necessary systems and overall compliance mechanism in motion for full implementation.

The centre has now put government departments on a compliance clock under the DPDP Act.² In a letter dated 20 August 2026, the Cabinet Secretary directed Union Ministries, State Governments and Union Territories to prepare time-bound implementation plans, designate senior officers, map personal data processing and review privacy notices, safeguards, third-party arrangements and grievance mechanisms.³

The move is significant. For much of the debate surrounding data protection in India, the focus has been on technology companies, banks and digital platforms. Yet, some of the largest repositories of citizens’ personal data are maintained by the State. Welfare databases, tax records, health information, educational records, identity documents, land records and employment information are routinely collected and processed by government departments.

The question, therefore, is not merely whether the government will “comply” with the DPDP Act. It is whether the State can exercise its enormous capacity to collect and use personal data while remaining accountable to the citizens whose data it controls.

The State is not an ordinary data fiduciary

The DPDP Act places obligations on a “data fiduciary”. An entity that determines the purpose and means of processing personal data. Government departments can plainly fall within this framework when they determine why and how citizens’ data is processed.

But government processing is different from private-sector processing. A consumer can often refuse to provide data to a private platform. The relationship between a citizen and the State is different. Refusing to provide information may mean losing access to a welfare scheme, licence, public service or statutory entitlement.

This makes consent an inadequate measure of government accountability.

Section 7, DPDP Act recognises several “legitimate uses” for processing personal data, including processing by the State for providing benefits, services, certificates, licences or permits and for performing functions under law. The significance of this provision is that government processing will frequently operate without conventional consent.

The real questions, therefore, become: What data is necessary? For what purpose? For how long? Who can access it? Can it be shared with another department? Can it be given to a private contractor? And what happens when the original purpose disappears?

From data collection to data minimisation

The government has a legitimate need to process personal information. A welfare department cannot distribute benefits without knowing who is eligible. A tax authority cannot perform its functions without financial information. A health department may need personal information to deliver public healthcare.

But the legitimate purpose does not mean unlimited collection.

The Supreme Court’s decision in K.S. Puttaswamy (Privacy-9J.) v. Union of India⁴, recognised privacy as a fundamental right under Article 21⁵ and emphasised legality, legitimate State aim and proportionality when State action interferes with privacy.

The Aadhaar judgment subsequently demonstrated how these principles operate in practice.⁶ The Supreme Court upheld several aspects of the Aadhaar framework but also invalidated provisions that permitted wider use of Aadhaar information than constitutionally justified.⁷ The Court recognised that the State’s pursuit of welfare objectives cannot automatically override an individual’s privacy.

This principle is particularly important in the age of interoperable databases. Data collected for one purpose can easily become useful for another. A database created for welfare delivery may subsequently be useful for taxation, law enforcement or eligibility verification. Such “function creep” may be administratively convenient, but convenience cannot by itself answer the constitutional question of necessity and proportionality.

The vendor problem

The Cabinet Secretary’s direction to examine third-party arrangements is therefore especially important. Government departments increasingly depend upon private technology companies, cloud providers, consultants, and system integrators to process citizens’ data.

The fact that a private company processes data on behalf of the government does not make the State’s responsibility disappear.

Contracts must address access, security, retention, deletion, subcontracting and breach management. More importantly, government departments must know where citizens’ data is stored, who can access it and what happens to it after the contractual relationship ends.

Data protection cannot stop at the government department’s server room if public services are increasingly delivered through private technological infrastructure.

Privacy versus transparency: DPDP Act and RTI regime

The tension between data protection and transparency is particularly visible in the DPDP Act’s amendment to the Right to Information Act, 2005 (RTI Act). Section 44(3), DPDP Act replaced Section 8(1)(j), RTI Act with a broader exemption for “information which relates to personal information”. The earlier provision permitted disclosure where the information related to public activity or public interest, and contained a larger public-interest safeguard. The amendment has consequently raised a difficult question: Can the protection of personal data become so broad that it weakens the citizen’s ability to scrutinise the State? This question is now before the Supreme Court in Venkatesh Nayak v. Union of India⁸, along with connected petitions challenging the constitutional validity of the amendment. The court has recognised that the issue requires careful balancing of competing fundamental rights and has referred the matter to a larger Bench. The point is not that privacy and transparency are inherently opposed. Rather, both are instruments of democratic accountability: Privacy protects individuals from unjustified State intrusion, while access to information enables citizens to hold public authorities accountable. A data-protection regime that protects officials’ personal information without adequately distinguishing it from information necessary to expose corruption, conflicts of interest or abuse of public power could inadvertently strengthen the State against the citizen.

Exemptions and accountability

The issue becomes more complicated because the DPDP Act itself gives the government significant exemption powers. Section 17⁹ permits exemptions in specified circumstances, including for certain State instrumentalities on grounds such as sovereignty, security, and public order.

These exemptions may be necessary. National security and law enforcement cannot operate under exactly the same rules as an ordinary commercial transaction. But exemptions must not become a substitute for accountability.

This is particularly relevant because the constitutional challenge to the DPDP framework is already before the Supreme Court. Among other provisions, petitioners have challenged Section 17(2)(a)¹⁰, as well as provisions concerning government access to information and the institutional design of the data-protection regime.

The larger constitutional question is therefore still open: How much discretion can the State exercise over personal information while remaining consistent with Articles 14, 19 and 21?

Compliance must mean more than a checklist

The present government-wide exercise is a welcome step. But its success should not be measured merely by the appointment of nodal officers or preparation of data inventories.

Government departments should instead ask five basic questions:

Why are we collecting this data?

What law authorises its collection?

Is all of it necessary?

Who can use it, and for how long?

What remedy does the citizen have if the data is misused?

These questions bring together the DPDP Act and the constitutional principles developed in K.S. Puttaswamy (Aadhaar-5J.) v. Union of India¹¹.

The DPDP Rules have already been notified, while the substantive obligations of the Act are scheduled to come into force in phases, with the principal data fiduciary obligations taking effect in May 2027. The government therefore has an important opportunity to build privacy safeguards into public administration before compliance becomes merely a deadline-driven exercise.

The real promise of the DPDP Act lies beyond regulating private companies. It can change how the State itself thinks about citizens’ data. Governments should not regard personal information merely as an administrative resource. It is information connected to individual autonomy, dignity, and constitutional liberty.

The ultimate test of India’s data-protection regime will therefore not be how efficiently the State can collect and process data, but how willing it is to place legal and institutional limits on its own power to do so.