The Centre has begun pushing its own ministries, departments and state governments towards compliance with the Digital Personal Data Protection Act, asking them to appoint senior officials, set implementation timelines and overhaul how they collect, process and protect citizens’ personal data.
In a letter to Secretaries of the Government of India and Chief Secretaries of states and Union Territories, Cabinet Secretary TV Somanathan has asked government bodies to prepare phased implementation plans with clearly defined responsibilities and timelines. Progress is to be reviewed periodically by the Secretary or Chief Secretary concerned, putting responsibility for implementation directly with the administrative leadership of each ministry and state.
Somanathan has also asked each ministry, department and state to designate a senior officer to oversee implementation and nominate a nodal officer to coordinate with the Ministry of Electronics and Information Technology (MeitY), the nodal ministry for the law. “A senior officer is designated to oversee implementation of the Act” and “a nodal officer is nominated for coordination with the Ministry of Electronics and Information Technology”, he said in the August 20 letter.
Establishing Data Inventories
The exercise will require government organisations to first establish how and where they process personal data. The Cabinet Secretary has called for identification of personal-data processing activities and preparation of appropriate data inventories, along with a review of privacy notices, consent mechanisms wherever applicable and grievance-redressal arrangements. They will also have to strengthen technical and organisational safeguards and review contractual arrangements with third-party vendors and data processors.
An important part of the exercise will be embedding privacy considerations into government technology rather than treating them as a compliance requirement after systems have been built. Ministries and states have been asked to incorporate privacy-by-design principles into the development, enhancement and operation of digital government services and review legacy systems in a phased, risk-based manner.
The push is significant because government is among the country’s largest collectors and processors of citizens’ personal data, with digital systems spanning welfare delivery, taxation, healthcare, identity and a range of other public services. The implementation of the DPDP Act within government systems will therefore be an early test of how privacy requirements translate into the country’s expanding digital public infrastructure.
Capacity Building
The Cabinet Secretary has also called for capacity building and sensitisation of officers responsible for implementing the law, alongside appropriate governance mechanisms and institutional processes. This will require departments to examine not only their technology systems but also internal processes governing access to, use and protection of personal information.
MeitY has already begun preparing guidance material, conducting awareness initiatives and capacity-building programmes and consulting stakeholders to support implementation. It will continue to provide implementation support to ministries, departments and state and Union Territory administrations.
The August 20 letter asks government bodies to accord the matter “high priority” and initiate appropriate institutional, administrative and technical measures for timely implementation of the 2023 law. Somanathan has also sought a brief note on the status of implementation from each ministry, department and state so that “common implementation issues requiring guidance or support may be addressed in a coordinated manner”.