Government Bodies and PSUs: A DPDP Act Impact Study

Executive summary

A ration card, a land record, a child's growth chart at the anganwadi: much of what Indians disclose about themselves ends up with a government office. The Digital Personal Data Protection Act, 2023 (the DPDP Act) does not exempt those offices. "The State", as defined in Article 12 of the Constitution, is a "person" under s.2(s), so a ministry, a municipality or a public sector undertaking (PSU) can be a data fiduciary (the body that decides why and how personal data is processed), and the Data Protection Board can penalise it.

The Act does give the State more room than anyone else: two legitimate uses of its own, relief from erasure duties, and a power for the Centre to take notified agencies outside the Act. The main obligations commence on 13 May 2027.

Headline rating: Overall impact High. Six of the twelve areas in the Trayambic scorecard are rated High.

The three biggest changes:

1. 1.Each activity needs the right ground. A function conferred by statute fits s.7(c). A scheme run on an executive order fits s.7(b) only where the person has previously consented to State processing or her data sits in a notified database, and only to the Second Schedule's standards. Extras need consent.
2. 2.Security and breach duties apply in full. A leaked beneficiary list means notice to the Board and to every person on it, on top of CERT-In's six-hour clock.
3. 3.PSUs must earn the State's grounds activity by activity. In our view a government company that is "State" may use s.7(b) and (c) for public functions, not for business it runs like any competitor.

Trayambic's energy and agritech studies cover State-owned discoms and AgriStack.

Background

In scope are Union and State ministries and departments with their attached offices and district administrations; municipal corporations, municipalities, panchayats and smart-city companies; statutory bodies and regulators; PSUs, both statutory corporations and government companies; and scheme societies and mission directorates.

The data principals (the individuals the data is about) are applicants, beneficiaries and their families, taxpayers, licence holders, complainants, patients and students in public institutions, employees, pensioners and people caught on public cameras. The data includes Aadhaar numbers, ration and family cards, income, caste and disability certificates, land records, bank accounts for direct benefit transfer, health and nutrition records, grievance files and CCTV footage.

A typical flow: a citizen applies at a portal, a common service centre (CSC) or a counter. A department system, often built and run by the National Informatics Centre (NIC) or a private system integrator acting as a data processor (processing on the department's behalf), checks her against other databases. Payments go through banks. Data then reaches auditors, RTI applicants, social audit teams and dashboards, and increasingly analytics and AI platforms.

Legal framework

The DPDP provisions that matter most

• The State as a person. Section 2(s)(vi) lists "the State"; s.2(zb) adopts Article 12, which covers the Union and State governments and legislatures and "all local or other authorities" in India or under the Government of India's control. Penalties go to the Consolidated Fund of India (s.34). Files that stay on paper are outside the Act (s.3).
• Section 7(b). The State and its instrumentalities may process data to provide a subsidy, benefit, service, certificate, licence or permit where (i) the person has previously consented to State processing for any such benefit, or (ii) the data is in a State database the Centre has notified. The Act's illustration: a woman who enrols for a maternity benefit may have her data used to check her eligibility for other prescribed benefits.
• Rule 5 and the Second Schedule. Rule 5(2) covers benefits provided under law, under a Central or State executive policy, or using public funds, including a local authority's own funds. The Second Schedule requires lawful, purpose-limited and minimal processing, reasonable accuracy, retention only as long as needed or legally required, safeguards extending to processors, and accountability. For s.7(b), the person must be told whom to contact and how to exercise her rights.
• Section 7(c) covers any function under any law in force in India, or in the interest of sovereignty, integrity or the security of the State.
• Exemptions. Section 17(1)(c) covers offences but keeps the duties of responsibility and security. Section 17(2)(a) lets the Centre disapply the Act for an instrumentality it notifies on grounds such as security and public order. Section 17(2)(b) covers research and statistics not used for decisions about a person.
• Section 17(4). For processing by the State, the erasure duty (s.8(7)) and the right to erasure (s.12(3)) do not apply, nor does the right to correction (s.12(2)) where no decision affecting the person is involved.
• Children. The Fourth Schedule, Part B, lifts verifiable parental consent and the tracking ban for functions under law in a child's interest and for publicly funded s.7(b) benefits, to the extent necessary.
• Calls for information (s.36; Rule 23; Seventh Schedule). The Centre may require any fiduciary to furnish information for listed purposes, including security and assessing designation as a Significant Data Fiduciary (SDF), and where security requires may bar it from telling the person.
• RTI (s.44(3)). Since 13 November 2025, s.8(1)(j) of the Right to Information Act exempts "information which relates to personal information", without the clause's former larger-public-interest test.

We found no notification under s.17(2)(a), which commences only on 13 May 2027; in December 2023 MeitY told the Lok Sabha that no organisation had been exempted. We found no database notified under s.7(b)(ii). No Board members had been appointed as of October 2026.

Sector instruments

The 2026 framework is the newest layer. Its committee's remit includes a "prohibition of re-identification", and it names AIKosh, the IndiaAI datasets platform launched on 6 March 2025, for anonymised bulk data. The draft National Data Governance Framework Policy of May 2022, which proposed an India Data Management Office, was never finalised as far as we can find; in our view the 2026 framework replaces it.

How sections 38 and 16(2) fit together

Section 38 makes the DPDP Act additional to other laws and decisive in a conflict. Statutes conferring functions supply the s.7(c) ground; the Aadhaar Act decides when Aadhaar may be demanded; the Public Records Act governs destruction; RTI s.8(2) still allows disclosure in the public interest. Section 16(2) preserves stricter transfer limits, such as s.4 of the Public Records Act.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Law, scheme or consent: choosing the ground

Ask three questions of each activity.

Does a statute confer the function? Property tax, birth registration, licensing, policing and municipal services rest on s.7(c). A purpose written only into an office order is not a function under law.

Is it a benefit under a policy or from public funds? Many welfare schemes run on executive orders, so s.7(c) is often unavailable and s.7(b) applies. It needs one of two gateways:

• Prior consent to State processing. In our view this should meet the s.6 standard (free, specific, informed, unconditional and unambiguous) and be recorded. For people enrolled before commencement, review the old forms: where the wording covered State processing, give notice as s.5(2) contemplates; otherwise refresh consent at the next renewal or e-KYC.
• A notified database. None has been notified. Departments with large registries should ask MeitY to notify them rather than lean on patchy legacy consent.

Either way, the Second Schedule intimation must reach the person.

Neither? Then consent with a Rule 3 notice, or s.7(a) for data a person voluntarily provides for a specified purpose, such as a grievance.

Two cautions. The DPDP Act does not widen the power to demand Aadhaar: mandatory authentication still needs a s.7 notification with an alternative route, and good-governance approvals stay voluntary. And each department receiving shared data needs its own ground, recorded in the ministry's new sharing procedure.

PSUs: State in name, not always in purpose

Is the PSU "State"? The seven-judge bench in Pradeep Kumar Biswas v Indian Institute of Chemical Biology, (2002) 5 SCC 111, asked whether a body is "financially, functionally and administratively dominated by or under the control of the Government". In 2022 the Supreme Court restated that regulatory control or some public function alone is not enough. In our view statutory corporations and wholly owned government companies usually pass; joint ventures, listed companies and subsidiaries need a case-by-case view.

Can it use the State's grounds? We think being State is necessary, not sufficient. Section 7(c) needs a function under law: a statutory corporation has statutory functions, but a government company's trading business is authorised by its memorandum, not by law. Section 7(b) covers benefits under law, executive policy or public funds; a service sold at market rates is usually none of these.

The Trayambic view. A PSU should use s.7(b) and (c) for scheme administration, statutory and regulatory functions, and work done as the government's agent. For products sold in competition with private firms, such as insurance, banking, telecom and travel, it should rely on consent or s.7(a). State grounds there would strip customers of the access and correction rights their private-sector peers enjoy, and in our view a regulator or court is likely to read the grounds narrowly.

Section 17(4) needs the same discipline. Read literally, it turns on who processes, not why, so a State-owned insurer could claim no statutory erasure duty for any customer. We would not rely on that for commercial data. A PSU also pays penalties from its own funds and, as a body corporate, faces s.43A of the IT Act until 13 May 2027.

What the State is spared, and what it is not

Spared. Section 17(4) removes the erasure duty and right. Access and correction (ss.11 and 12) run only against fiduciaries processing on consent or s.7(a), so people processed under s.7(b) or (c) have no statutory access right. Notice under s.5 attaches to consent, so s.7(c) carries no notice duty.

Not spared.

• Security and breach. Section 8(5), Rule 6, s.8(6) and Rule 7 apply in full.
• Accuracy. Where data drives eligibility, deduplication or removal from a beneficiary roll, s.8(3) requires it to be complete, accurate and consistent, and the correction right revives because a decision is involved.
• Grievances. Section 13 applies to every fiduciary, with replies within 90 days at most (Rule 14).
• Retention. The Second Schedule limits retention of s.7(b) data, and central bodies must follow approved records schedules.
• Penalties. A State government's penalty moves money to the Union; for departments, we expect a Board finding to matter more for the public record than for its cost.

RTI. Information officers can now refuse personal information without weighing public interest under clause (j), though s.8(2) still permits disclosure. In our view the exemption protects the person the information is about and should not be used to refuse people their own records. With no DPDP access right, RTI and grievances become their routes in; offer access and correction voluntarily.

Vendors, transparency uploads and datasets

Processors. NIC, system integrators, CSCs, call centres and cloud providers act for the department, which stays responsible "irrespective of any agreement to the contrary" (s.8(1)). Each needs a valid contract (s.8(2)) with Rule 6 controls, incident notice that fits the six-hour clock, sub-processor approval, audit rights and erasure at exit. Keep logs for a year, as Rule 6 requires, not CERT-In's 180 days.

Transparency uploads. Section 3(c)(ii) takes data outside the Act only where a person under a legal obligation publishes it; a list published by choice remains personal data in the department's charge. Publish only what the obligation needs, and mask Aadhaar, bank and phone numbers.

Analytics and AI. Data that identifies no one is outside the Act, but linking can re-identify people. Anonymise and test before sharing with platforms such as AIKosh, and use s.17(2)(b) only for research that informs no decision about a person.

Worked example (illustrative): a municipal corporation

A corporation serving 12 lakh residents runs property tax, licences, birth and death registration, a grievance app, CCTV through its smart-city company, and a State housing scheme. A system integrator runs its ERP.

• Grounds. Tax, licences, registration and municipal CCTV rest on s.7(c). The housing scheme, run under State policy with public funds, rests on s.7(b): the application form adds consent to State processing and the Second Schedule intimation, and existing beneficiaries get notice with the next instalment. Grievances fit s.7(a); promotional app messages need consent.
• Aadhaar. Authentication is used because the scheme is notified under s.7 of the Aadhaar Act, with another document accepted from anyone without a number.
• Vendors. The integrator and the smart-city company sign processing terms: instructions only, hosting in India, two-hour incident notice, erasure at exit.
• The incident. A ward office uploads the beneficiary list, with Aadhaar and bank account numbers, as a PDF. The corporation takes it down, reports to CERT-In within six hours, tells the Board without delay, files the 72-hour report and informs each beneficiary by SMS and through ward offices. Penalties can reach ₹250 crore for failed safeguards and ₹200 crore for failed notice, weighed under s.33(2). Future lists show names and wards only.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: activity map; PSU status notes; data governance committee; security gap assessment.
• January to March 2027: scheme forms; vendor terms; runbook; notification requests.
• April to May 2027: retention; rights process; masking rules; a breach drill with the integrator.
• Ongoing: s.17(2)(a) notifications; Board appointments; the RTI challenge.

Recommendations

1. 1.Record a ground for every activity: the statute for s.7(c), the policy or fund for s.7(b), consent for everything else.
2. 2.Fix scheme forms now, and seek notification of core registries rather than relying on old consent wording.
3. 3.Have each PSU board approve a note on State status and confine State grounds to public functions.
4. 4.Treat security, breach and vendor duties as fully applicable, with one runbook that meets the six-hour clock.
5. 5.Give people access and correction even where the Act does not require it.
6. 6.Publish less: mask identifiers in transparency lists and anonymise properly before data goes to analytics or AI platforms.

Key takeaways

• The State is a 'person' under s.2(s): ministries, municipalities and PSUs are data fiduciaries and can be penalised.
• Statutory functions fit s.7(c); policy schemes fit s.7(b) only with prior consent to State processing or a notified database, plus the Second Schedule standards.
• In our view PSUs should use State grounds only for public functions, and consent or s.7(a) for commercial products.
• Section 17(4) lifts erasure duties, but security, breach notice, accuracy, grievances and penalties apply in full.
• No s.17(2)(a) exemption or s.7(b)(ii) database had been notified as of October 2026.