Agritech and the DPDP Act: An Industry Impact Study

Executive summary

Agritech collects personal data where forms are hard to use. A farmer may not read the notice, may share a phone with her son or the input dealer, and may give her details to a field agent who fills in the app for her. Advisory apps, input marketplaces, farmer producer organisations (FPOs), loan and insurance distributors and drone services all build on that moment.

They also build on government platforms. The AgriStack Farmer Registry links a Farmer ID to State land records, and crop insurance, income support and fertiliser subsidy run on Aadhaar-linked databases. Because so much of this data is visible to someone, it is easy to treat it as free. The Digital Personal Data Protection Act, 2023 (the DPDP Act) does not.

Headline impact rating: Medium-High. Three of the twelve areas in the Trayambic scorecard are rated High. The three biggest changes are:

1. 1.Consent must work in the field. Notices must be itemised and available in English or an Eighth Schedule language, and the business must prove notice and consent (s.6(10)). Agent-assisted, spoken and thumbprint consents must pass that test.
2. 2.Scheme and registry data is not a free input. The legitimate use for subsidies in s.7(b) belongs to the State. A private business reusing scheme or registry data for its own products usually needs consent.
3. 3.Every intermediary needs a defined role. Field agents, common service centres (CSCs), FPOs, drone operators, lenders and insurers each act for the business or for themselves, and contracts and notices must say which.

The main obligations commence on 13 May 2027; consent managers can register from 13 November 2026.

Background

Who this study covers

The DPDP Act calls the organisation that decides why and how personal data is processed a data fiduciary, the individual concerned a data principal, and a business processing data on a fiduciary's behalf a data processor. This study covers:

• Farm advisory apps: crop, pest, weather and price advice by app, IVR, SMS or WhatsApp.
• Agri-input e-commerce: seeds, fertilisers, crop protection and equipment, online or through village stores.
• FPOs: farmer-owned businesses that aggregate produce and buy inputs for members.
• Agri-lending and insurance distributors: sourcing Kisan Credit Card (KCC) and other farm loans, and enrolling farmers for crop insurance.
• Precision-farming and drone services: satellite and drone imagery, field sensors and drone spraying.

Trayambic's studies on NBFCs and digital lending, microfinance and co-operative banks, and insurance cover those regimes in depth.

What data is collected and where it comes from

• Identity: name, phone number, photograph, Aadhaar e-KYC results (or, too often, Aadhaar photocopies) and increasingly the Farmer ID.
• Land and crop: survey numbers, record-of-rights extracts, plot coordinates, crops sown, soil tests and yields.
• Financial: bank accounts, KCC limits, loan and insurance applications, scheme receipts, input purchases and produce sales.
• Imagery and sensors: drone and satellite images, geo-tagged field photographs and sensor readings tied to a plot.

Much of it mirrors the government systems described below. Data principals include farmers, family members named in land and scheme records, field agents, drone pilots, and people and neighbouring plots caught in imagery.

Legal framework

The DPDP Act and Rules

• Scope (s.3): digital data, and paper data digitised later (s.3(a)). Data made public by the data principal, or by a person legally obliged to publish it, is excluded (s.3(c)(ii)).
• Grounds (ss.4, 6, 7): consent, or a closed list of legitimate uses. Section 7(a) covers data voluntarily provided for a specified purpose. Section 7(b) lets the State and its instrumentalities deliver subsidies, benefits and services where the person consented earlier or the data sits in a notified State database; Rule 5 and the Second Schedule add purpose-limitation, minimisation and notice standards.
• Notice (s.5, s.6(3), Rule 3): itemised, accessible in English or any Eighth Schedule language, with routes to withdraw consent, exercise rights and complain. Under s.6(10) the fiduciary must prove notice and consent.
• Duties (s.8, Rules 6 and 7): responsibility for processors, accuracy where data drives decisions (s.8(3)), security with logs kept for a year, breach notice to the Data Protection Board and each affected person, and erasure when the purpose ends.
• Rights (ss.11 to 14) and consent managers (s.6(7) to (9), Rule 4), the latter from 13 November 2026.

Agriculture instruments

• Digital Agriculture Mission (Cabinet, 2 September 2024; ₹2,817 crore). AgriStack has three State-maintained registries: farmers, geo-referenced village maps and crops sown, the last fed by a mobile-based Digital Crop Survey. The Farmer ID is "linked dynamically" to land records, livestock, crops and benefits. On 7 August 2026 the Ministry of Agriculture told the Rajya Sabha that over 10.31 crore Farmer IDs exist, that data is collected only with consent, that farmers control sharing "with authorized entities for specific purposes", that "the ownership of the data is with the respective States" and that AgriStack follows the DPDP Act. AgriStack's published design describes a Unified Farmer Service Interface for authorised users, including banks and agritech firms, with a consent manager for granting and revoking access.
• Pradhan Mantri Fasal Bima Yojana (PMFBY) Revamped Operational Guidelines (17 August 2020). Aadhaar has been mandatory since Kharif 2017 (para 6.4.1). Intermediaries must enter farmers' details on the National Crop Insurance Portal (NCIP) (para 6.3.1), including Aadhaar, land and address details, and insurers see farmer-level data with bank details (para 9.5). CSCs also enrol farmers (para 8.1). A release of 29 August 2026 describes the AIDE app for doorstep enrolment and pilots of CROPIC, which uses geo-tagged crop photographs.
• PM-KISAN. e-KYC by OTP, biometrics or face authentication is mandatory, and eligible beneficiary lists "must be displayed at the village level".
• Soil Health Card. The sampling app records each sample's latitude and longitude and assigns it a QR code; self-help groups (SHGs) and FPOs may run village labs.
• e-NAM. Sale proceeds go to farmers' registered bank accounts, and a "platform of platforms" adds finance, insurance and advisory services.
• Fertilisers and seeds. Subsidised fertiliser is sold against Aadhaar authentication on each shop's point-of-sale device, and s.29(3) of the Aadhaar Act bars using or disclosing that identity information beyond the purposes informed in writing at authentication. The SATHI portal provides digital seed traceability under the Seeds Act regime; a draft Seeds Bill, 2025 (December 2025) would register dealers.
• Drones. The Drone Rules, 2021 (G.S.R. 589(E), 25 August 2021) run registration, pilots and airspace through the Digital Sky platform; a 2022 amendment replaced the pilot licence with a certificate. Registration and certification have since moved to the DGCA's eGCA system; pilots provide a government identity document and address proof. A draft Civil Drone (Promotion and Regulation) Bill, 2025 (16 September 2025) would require operation records to be produced to the DGCA and law enforcement on demand (clause 30); it has no privacy clause.
• FPOs are producer companies under Chapter XXIA of the Companies Act, 2013 (s.378A onwards, inserted in 2020) or co-operatives. The 10,000 FPO scheme guidelines call for a shareholder list showing each member's land with its khasra number, an Integrated Portal tracking membership and data collection by Cluster Based Business Organisations (CBBOs), and allow defaulters to be listed on the portal (para 12.11(xi)).
• Lending and insurance. The RBI Digital Lending Directions 2025 bar access to a phone's files and contacts and require consent before sharing (paras 12(i), 12(iv)); IRDAI's 2025 records regulations set a ten-year minimum.
• CERT-In Directions (28 April 2022): incident reports within six hours and 180 days of logs.

How the layers fit

Section 38 makes the DPDP Act additional to other laws and lets it prevail in a conflict; s.16(2) saves stricter transfer rules. Much of the agriculture layer is scheme guidelines, not statute. In our view, a guideline governs what a participant does with data inside the scheme; it supplies no DPDP ground for using the same data outside it.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Consent when the farmer cannot read the form

Rule 3 wants a notice that stands on its own, itemises data and purposes, and explains withdrawal, rights and complaints, in English or any of the 22 Eighth Schedule languages. Trayambic's microfinance study covers doorstep notices; agritech adds three problems.

Spoken consent. Advisory services often run on IVR and voice notes. The Act does not demand writing; it demands a "clear affirmative action" (s.6(1)). In our view a recorded spoken "yes", given after the notice is read out in the farmer's language, can qualify if the business can produce it later. Store the recording, link it to the notice version read, send a written copy with the helpline and withdrawal route, and ask separately for each purpose the service does not need. Withdrawal must be as easy as consent (s.6(4)), so a call or keypress must be enough.

Languages outside the Schedule. Gondi and Lambadi, for example, are not in the Schedule. The written copy can be in the nearest Schedule language, but the explanation should be in the language the farmer speaks; a Hindi PDF she cannot read will not prove informed consent. Government services already manage this: the PM-KISAN chatbot, Kisan e-Mitra, works in eleven languages.

Assisted and borrowed consent. When an agent fills in the app, the affirmative action must still be the farmer's: an OTP to her own phone, her thumbprint or her recorded voice. An OTP that lands on the dealer's phone, or a box the agent ticks, is evidence against the business; paying agents per consent makes both likelier. Ask each farmer which number is hers, and log each consent with time, channel, language, notice version and agent.

Public platforms, private purposes

The State's ground does not transfer. A CSC or insurance intermediary enrolling farmers for PMFBY processes data for the scheme; in our view it may rely on the scheme's basis while doing so. Reusing the same Aadhaar, land and bank details to sell its own products is a new purpose that needs consent. At the fertiliser counter, Aadhaar Act s.29(3) adds a statutory bar on reuse.

Registry access is consent-based, not open. The Ministry says States own AgriStack data and farmers control sharing with authorised entities. We have not found a published national policy on which private firms may be authorised, on what terms or with what audit; in 2022 the Ministry said access to the federated farmers' database was "with Government only". Treat every registry pull as the firm's own consent request, with its own notice and record, and expect terms to vary by State.

Visible is not the same as public. PM-KISAN lists are displayed in villages. Section 3(c)(ii) excludes data published by a person "under an obligation under any law" to publish it, but scheme guidelines are executive instructions, and in our view a business should not assume they qualify. Even where a statute requires publication, the exclusion covers the record as published, not a database joining it with phone numbers and purchase history. Scraping beneficiary lists for sales leads needs a ground.

Accuracy now carries legal weight. Land, crop and soil records feed loan limits, claims and advice. Where data drives a decision or goes to a lender or insurer, s.8(3) requires it to be complete, accurate and consistent.

Agents, FPOs and drones: who answers for the data

The fiduciary answers for its processors "irrespective of any agreement to the contrary" (s.8(1)).

• Field agents may be employees, contracted processors needing a s.8(2) contract, or village entrepreneurs who are fiduciaries for their own customers. The contract, app permissions and notice should give the same answer. Agents' phones sit inside the Rule 6 perimeter: no Aadhaar images in galleries, no customer lists on WhatsApp, and remote wipe.
• FPOs are fiduciaries for members' data. Membership records sit under s.7(a); sharing member-level data with buyers, input companies, lenders or platforms needs consent, and defaulter listings should go no further than the scheme requires. Even an FPO with no IT staff needs a named contact (s.8(9)) and a simple rights process; Trayambic's microfinance study covers co-operative member registers.
• Drone and imagery services hold pilot data (identity, certificates, flight records) and what the drone sees. An image of an unnamed field is not personal data; the same image tagged to a Farmer ID or name is (s.2(t)), and images also catch people, homes and neighbours' plots. Capture at the resolution the job needs, delete raw imagery promptly, and tell farmers that operation records may go to authorities.

Worked example: an advisory app with a village network

An agritech company works in two States through about 400 village agents (figures illustrative). Its app sells advice and inputs, refers farmers to a partner NBFC for crop loans and enrols them in PMFBY as an insurance intermediary. Agents photograph Aadhaar cards and land records and tick the consent box for the farmer. The company now wants to pre-fill loan forms from AgriStack, sell "farmer segments" to a seed company and train a pest model on drone images. From 13 May 2027:

• Agent-ticked consent will not hold, in our view, under s.6(10). Re-collect it by OTP or recorded voice in the farmer's language, purpose by purpose.
• Delete the Aadhaar photographs from servers and phones, move to authorised e-KYC, and record the deletion.
• The registry pull needs its own consent, naming the registry, fields and loan purpose. The NBFC is a separate fiduciary, and RBI rules also require consent before sharing.
• Seed-company segments need separate consent that the farmer can refuse without losing advice (s.6(1) consent must be "unconditional"), or aggregate segments that identify no one.
• PMFBY data stays in PMFBY. Selling the company's own add-on cover to the same farmers needs consent.
• Plot-linked drone images are personal data. Strip identifiers for model training or ask for consent.

Then an agent's phone is stolen with 300 Aadhaar images in its gallery. That is a personal data breach. The Board must be told without delay and given a detailed report within 72 hours, and each of the 300 farmers told what happened and what to do: in practice by call or visit, in her language, on the number she chose.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Appoint a DPO or other responsible person. Map agent onboarding and scheme work first, listing each government platform touched and the basis for each use.

January to March 2027. Rebuild voice and assisted consent, record notices in the main languages, amend intermediary contracts, harden agent devices and purge Aadhaar copies.

April to May 2027. Finalise imagery and retention policies, run a lost-phone breach drill, send notices to existing farmers and open a rights channel through agents and the helpline.

Ongoing. Track AgriStack access terms by State, Board guidance on spoken consent, and the drone and seeds bills. Audit agents' consent records quarterly.

Recommendations

1. 1.Make the farmer's own action the consent: an OTP to her number, her thumbprint or her recorded voice, never the agent's tap.
2. 2.Keep scheme work and commercial work apart. Data gathered for PMFBY, PM-KISAN or fertiliser subsidy stays there unless the farmer agrees to more.
3. 3.Treat AgriStack as consent-based infrastructure and record consent for every registry pull.
4. 4.Do not mine what is merely visible. Beneficiary lists and land-record portals are not a lead database.
5. 5.Write each intermediary's role into contracts and apps, and pay agents for quality, not consent volume.
6. 6.Decide when an image becomes personal data, and minimise links between imagery and named farmers.
7. 7.Plan breach notices for farmers without smartphones: call scripts and visits in their languages.

Key takeaways

• Agritech rates Medium-High on the Trayambic scorecard, with three of twelve areas rated High: notice and consent, legitimate uses, and processors and vendors.
• Consent must be the farmer's own action, provable under s.6(10): an OTP to her number, her thumbprint or a recorded voice consent after a notice in her language.
• Section 7(b) is the State's ground; reusing PMFBY, PM-KISAN, AgriStack or fertiliser-subsidy data for commercial products needs the farmer's consent.
• AgriStack data is owned by the States and shared on consent; we found no published national policy on private agritech access, so build for consent-based pulls.
• Field agents, CSCs, FPOs and drone operators each need a defined role, contract and device controls, because the business answers for its processors.