Energy Utilities and Smart Meters: A DPDP Act Impact Study

Executive summary

Electricity, piped gas and water reach almost every Indian home, and their suppliers are replacing the meter reader's notebook with networked meters that report many times a day. Distribution companies (discoms), city gas distribution (CGD) networks and water utilities therefore know who lives at an address, whether they own or rent, how they pay and, increasingly, when they are at home.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 apply to that data from 13 May 2027. A data fiduciary decides why and how personal data is processed; a data principal is the individual it is about; a data processor acts on a fiduciary's behalf.

Headline rating: Overall impact High. Five of the twelve areas in the Trayambic scorecard are rated High for a typical discom, CGD network or water utility.

The three biggest changes:

• Ownership decides the legal ground. A state-owned discom or municipal water board can use the State's legitimate uses in s.7(b) and (c); a private discom or CGD company cannot. The choice also decides whether consumers hold statutory access and correction rights.
• Meter data is personal data. Billing and running the network rest on legitimate uses; household profiles, demand response through third parties and sharing with vendors or lenders need consent.
• The metering vendor sits inside the data. Service providers own and operate smart meters and their data systems for the length of their contracts, the discom stays responsible for them, and one incident can mean reports to several agencies at once.

Trayambic's automotive and EV impact study covers charging-session data; this study touches it only briefly.

Background

The businesses in scope:

• Discoms, most state-owned and some private, which connect, meter, bill and disconnect consumers.
• Advanced Metering Infrastructure Service Providers (AMISPs), which supply, own and operate smart meters, networks and data systems for discoms.
• CGD entities authorised by the Petroleum and Natural Gas Regulatory Board (PNGRB).
• Water utilities: municipal corporations, water boards and their contractors.
• Rooftop solar vendors and EV charging operators, at the edges.

The data principals are consumers of record, tenants and other occupants, applicants, solar prosumers, subsidy beneficiaries, people inspected for suspected theft, complainants and staff.

The data includes identity and tenancy documents, consumer numbers, tariff category, bills, payments and arrears, meter readings and interval consumption, prepaid balances and recharges, phone numbers, inspection reports and solar generation.

It flows from the meter over a communication network to a head-end system and a meter data management system, then to billing, payment gateways and collection agencies, with copies at call centres, SMS providers, field apps, grievance forums, regulators and government portals.

Legal framework

The DPDP provisions that matter most

• Personal data and the State (s.2). A consumption record linked to a consumer number is personal data when the consumer is an individual. "State" means the State as defined in Article 12 of the Constitution (s.2(zb)).
• Grounds (ss.6, 7). Consent must be "free, specific, informed, unconditional and unambiguous", with an itemised notice (Rule 3). The relevant legitimate uses are s.7(a), data voluntarily provided for a specified purpose; s.7(b), the State providing a subsidy, benefit, service, certificate, licence or permit, where the person earlier consented to State processing or the data sits in a notified State database; s.7(c), the State performing a function under law; and s.7(d), disclosures the law requires. There is no legitimate-interests ground.
• Rule 5 and the Second Schedule. A "service" under s.7(b) includes one provided under law, policy or public funds. Processing must be lawful, purpose-limited, minimal, accurate, secure and time-limited, and the person must be told whom to contact and how to exercise her rights.
• Fiduciary duties (s.8; Rules 6, 7). Responsibility for processors "irrespective of any agreement to the contrary"; accuracy where data drives a decision (s.8(3)); security safeguards with a year of logs; breach notice to each affected person and the Board, with a 72-hour report; erasure once the purpose is served unless law requires retention.
• Rights (ss.11 to 13; Rule 14). Access and correction run only against a fiduciary processing on consent or s.7(a). Grievances must be answered within 90 days at most.
• Significant Data Fiduciaries (s.10). The Centre may designate an SDF on factors including data volume and security of the State; SDFs need an India-based Data Protection Officer, independent data audits and impact assessments.

Penalties reach ₹250 crore for security failures and ₹200 crore for breach-notice failures.

Sector instruments

Three developments are newer.

None of these instruments sets privacy rules for consumer data.

How sections 38 and 16(2) fit them together

Section 38 makes the DPDP Act additional to sector law and decisive in a conflict. The sector instruments supply records the law requires, which s.8(7) allows to be kept; disclosures to commissions, portals and NCIIPC, covered by s.7(d); and service duties, such as alerts and data access, that make some processing necessary. Section 16(2) preserves stricter sector rules on transfers abroad; the DPDP Act itself restricts no country.

No compression of the 13 May 2027 date has been notified, and no Board members had been appointed by October 2026.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

State or private: which ground, and which rights

Metering and billing look the same whoever owns the utility; the DPDP Act treats owners differently.

State-owned discoms and water boards. In our view a company owned and controlled by a state government is likely to be "State" under Article 12, and a municipal water board plainly is. Two grounds open up:

• Section 7(c), performing a function under law. Supplying electricity under the Electricity Act, or water under municipal law, is such a function. In our view this is the natural ground for supply, billing, prepayment and disconnection.
• Section 7(b), a subsidy, benefit or service. It also needs earlier consent to State processing or a notified database, so it suits subsidy schemes such as free power for farmers better than everyday supply. Where used, the Second Schedule standards apply.

The consequence is easy to miss. Access and correction under ss.11 and 12 run only against fiduciaries processing on consent or s.7(a), so a consumer processed under s.7(b) or (c) has no statutory access right. The Second Schedule still expects the utility to explain how she can exercise her rights, r.5(5) gives her consumption data and s.13 grievances apply to all. Offer access and correction regardless.

Private discoms and CGD companies. These cannot use s.7(b) or (c). Application data fits s.7(a). Meter readings are harder, because s.7(a) speaks of data the person "voluntarily provided" and a meter generates readings on its own. In our view, readings needed to bill and supply the connection she applied for stay within the purpose of her application, reinforced by the statutory duty to meter. Anything beyond supply, billing, safety and statutory reporting needs consent, and these consumers will hold ss.11 and 12 rights.

Mixed cases. Joint ventures, distribution franchisees and CGD companies with public-sector shareholders should not assume State status. Section 17(2)(a) helps only instrumentalities the Centre specifically notifies.

What a smart meter says about a household

Monthly readings show how much a household uses. Interval readings show when: the morning load, the gap while everyone is out, a week of near-zero draw during a holiday, the extra geyser cycles after a relative moves in. Prepaid recharges show when money runs short. That is a record of behaviour, valuable to anyone selling, lending or breaking in.

• The occupant may not be the consumer. Connections are often in a landlord's name, but interval data describes the tenant's life; both are data principals. Offer occupant-level access and limit the landlord's view during a tenancy. CGD companies already hold tenants' rent agreements or owners' no-objection certificates under the PNGRB regulations, so they can do this.
• Sort purposes into tiers. Billing, time-of-day tariffs, network operation, theft detection and statutory reporting rest on legitimate uses. Planning and loss analysis should use aggregates, as transformer-level energy accounting already does. Household insight reports, demand response through third parties and sharing with solar vendors, lenders or appliance sellers each need consent that can be withdrawn without affecting supply.
• Keep only the resolution the purpose needs. Hold full-resolution interval data for billing and disputes, then aggregate. Data about a company is not personal data, so industrial meters raise fewer issues.

A separate EV charging connection adds a charging routine to the picture. Rooftop solar adds generation data: PM Surya Ghar applications pass through a national portal to the discom, while the vendor the consumer picks is a separate fiduciary for its own sales.

AMISPs, security and a single incident clock

Under RDSS an AMISP supplies the meters, owns them for the contract period and typically runs the head-end and data management systems. The discom is the fiduciary and the AMISP its processor, and s.8(1) keeps the discom responsible whatever the contract says. The contract must therefore carry processing only on instructions, Rule 6 security, sub-processor approval, audit rights, prompt incident notice, and return and erasure at handover (s.8(7)(b)). The same goes for billing, payment, call-centre and meter-reading vendors; Trayambic's vendor contracts checklist sets out the clauses.

Security here is also safety: a compromised head-end system can remotely cut supply to thousands of homes and expose their data at once. Where a utility's systems are declared protected under s.70 of the IT Act, the Protected System Rules require real-time log sharing with NCIIPC; those logs contain personal data, and the disclosure falls within s.7(d).

One incident can trigger several reports:

• CERT-In, within six hours;
• NCIIPC, for protected systems;
• the Board, without delay, with a detailed report within 72 hours;
• each affected consumer, without delay.

Build one runbook, and set the AMISP's notice period short enough to meet the six-hour clock.

Prepaid meters and automated cut-offs

Section 56(1) requires fifteen clear days' written notice before disconnecting for unpaid bills. With prepayment, the meter cuts supply when credit runs out, and r.9(3) says this "shall however not be treated as a disconnection". The protection of notice falls away and the cut-off becomes an automated decision driven by data.

That engages s.8(3): data used for a decision affecting the data principal must be complete, accurate and consistent. A wrong tariff, meter mapping, recharge record or reading can switch off the wrong home, or the right one too early. Controls:

• verify consumer-to-meter mapping whenever meters are swapped;
• reconcile recharges promptly and treat failed payment callbacks as urgent;
• send low-balance alerts to the person actually living there, updating contacts when occupants change;
• pause automatic cut-offs when communication failures make balances unreliable;
• log every remote switching command and who issued it.

Disputes run through the grievance forum's 45-day limit and the 2024 check meter, both faster than the 90-day outer limit in Rule 14; meet the faster one.

Worked example (illustrative): a state-owned discom

A state-owned discom serves 40 lakh consumers; two AMISPs are installing 18 lakh smart prepaid meters under RDSS. It runs an app, a free-power scheme for farmers and an aggregator pilot to shift air-conditioning load.

• Grounds. Supply, billing, prepayment and disconnection under s.7(c); the farm subsidy under s.7(b) and the Second Schedule; returns to the State Commission under s.7(d). The app's neighbour-comparison report and the pilot run on consent.
• Notice. A short statement in bills, the app and SMS, in the state language and English, gives the grounds, contacts and how to raise requests; access and correction are offered to all.
• Vendors. AMISP contracts now require processing on instructions, hosting in India, incident notice within two hours, no reuse of meter data and erasure at handover. The aggregator gets only enrolled consumers' data.
• Granularity. Interval data stays at full resolution for 12 months (an internal choice), then rolls up to daily totals.
• Tenants. Occupants register for alerts and usage views on proof of tenancy; landlords see bills, not interval data.
• An incident. An AMISP interface flaw exposes addresses and balances. The discom suspends remote disconnection, reports to CERT-In within six hours, notifies the Board and affected consumers, and files the 72-hour report.

A private city discom would rely on s.7(a) and consent instead, and its consumers would hold statutory access and correction rights.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: State status; data and vendor map; draft runbook; cyber gap assessment.
• January to March 2027: contracts; notices; prepaid controls; retention.
• April to May 2027: consent flows; occupant access; rights channel; breach drill with AMISPs.
• Ongoing: the 2026 cyber regulations; consumer rights amendments; SDF designations.

Recommendations

1. 1.Settle the ground first: decide State status, then choose s.7(c), s.7(b), s.7(a) or consent activity by activity.
2. 2.Treat interval data as household behaviour: aggregate early and put non-billing uses behind consent.
3. 3.Write DPDP terms, including erasure at handover, into every AMISP contract.
4. 4.Put accuracy controls around prepaid cut-offs; an automatic disconnection is a decision about a person.
5. 5.Give tenants their own access and alerts, and limit what landlords see.
6. 6.Run one incident process across CERT-In, sector agencies, NCIIPC, the Board and consumers, and offer access and correction even where the Act does not require it.

Key takeaways

• State-owned discoms and water boards can rely on s.7(b) and (c) with the Second Schedule standards; private discoms and CGD companies need s.7(a) and consent.
• Consumers processed only under s.7(b) or (c) lack statutory access and correction rights under the Act; utilities should offer them anyway.
• Smart meter interval data reveals household routines; billing and network uses rest on legitimate uses, everything else on consent.
• AMISPs are the discom's processors, and s.8(1) keeps the discom responsible; contracts must cover security, incident notice and erasure at handover.
• Prepaid cut-offs are not 'disconnection' under the consumer rights rules, so s.8(3) accuracy controls must do the work notice used to do.