Delayed Data Protection Rollout Weakens Privacy and Transparency Framework

Context:

• The Digital Personal Data Protection Rules, 2025 were notified on November 14, 2025, operationalising provisions of the Digital Personal Data Protection Act, 2023.

• While projected as a major step toward safeguarding citizens’ digital privacy, the Rules postpone key protections until 2027, raising concerns over erosion of transparency, accountability, and individual rights.

Key Highlights:

Government Initiative / Policy Details

• The Rules provide the operational framework for India’s data protection regime.

• A 12–18 month compliance window has been granted to technology companies to align systems and processes.

• The Data Protection Board of India (DPBI) is established as the adjudicatory authority.

Timeline and Implementation Gaps

• Though notified in 2025, critical safeguards for citizens’ data will become effective only by 2027.

• In contrast, certain amendments—particularly affecting the Right to Information (RTI) Act, 2005—take effect immediately.

Changes to RTI and Transparency

• Amendments empower Public Information Officers (PIOs) to withhold personal information beyond what is explicitly mandated for disclosure.

• This narrows citizens’ ability to seek accountability from public authorities.

• The balance shifts away from transparency toward administrative discretion.

Institutional Design and Governance Concerns

• The DPBI functions under the Ministry of Electronics and Information Technology (MeitY).

• This raises concerns of conflict of interest, as the same ministry:

  • Regulates data protection

  • Courts investments from data-intensive technology companies

• Lack of statutory independence may undermine impartial enforcement.

Historical Background

• The Supreme Court recognised the Right to Privacy as a Fundamental Right in 2017.

• Since then:

  • Multiple draft data protection bills were proposed.

  • The 2023 Act simplified the 2018 draft but expanded government exemptions in data handling.

• The 2025 Rules continue this trend by prioritising administrative flexibility over citizen safeguards.

Significance / Concerns

• For citizens:

  • Prolonged exposure to weak privacy protections.

  • Limited remedies against data misuse by the State or private entities.

• For governance:

  • Dilution of RTI weakens democratic oversight.

  • Delay contradicts the urgency implied by digitalisation and rising data breaches.

• For accountability:

  • Absence of an independent regulator reduces trust in enforcement.

  • Risks normalising surveillance and opaque data practices.

UPSC Relevance (GS-wise):

GS 2 – Polity

• Fundamental Right to Privacy

• Balance between transparency (RTI) and data protection

• Constitutional implications of delegated legislation

GS 2 – Governance

• Regulatory institutions and their independence

• Accountability of executive action

• Impact of digital governance on citizen rights

GS 3 – Science & Technology

• Data governance and digital economy

• Regulation of Big Tech and data fiduciaries

• Cyber security and data protection frameworks

Prelims Focus:

• Digital Personal Data Protection Act, 2023

• Data Protection Board of India

• Amendments to RTI Act

• Right to Privacy (Puttaswamy judgment)

Mains Orientation:

• Critically examine whether India’s data protection framework adequately balances privacy, transparency, and governance needs.

• Discuss the implications of delayed implementation and weak institutional independence on democratic accountability.