Lok Sabha Question No. 2107 (UNSTARRED), answered on 2025-03-12
Subject: Data Processing by State Agencies under DPDP Rules, 2025
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Shri Anurag Singh Thakur

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 2107

TO BE ANSWERED ON: 12.03.2025

## DATA PROCESSING BY STATE AGENCIES UNDER DPDP RULES, 2025

## 2107.  SHRI ANURAG SINGH THAKUR:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether State agencies are permitted to process personal data without fresh consent, provided individuals are informed under Rules 5 of the Draft Digital Personal Data Protection (DPDP) Rules 2025;
- (b)  the  details  of  the  specific  circumstances  and  types  of  personal  data  to  which  this  provision applies to;
- (c) the measures being implemented to ensure transparency in such data processing;
- (d) the manner in which the individuals are likely to be adequately informed about the usage of their personal data;
- (e)  the  manner  in  which  the  Government  is  likely  to  balance  efficient  governance  with  the fundamental right to privacy as upheld by the Hon'ble Supreme Court of India while considering privacy concerns;
- (f)  whether  there  are  plans  to  establish  oversight  or  grievance  redressal  mechanisms  to  address concerns related to this provision; and
- (g)  the  manner  in  which  the  Government  intends  to  align  this  rule  with  global  best  practices particularly in jurisdictions where explicit consent is fundamental?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a)  to  (g):The  Digital  Personal  Data  Protection  Act,  2023  ('Act')  encapsulates  the  essential principles  such  as  lawful  purpose,  purpose  limitation,  data  minimisation,  data  accuracy,  storage limitation,  reasonable  security  safeguards  and  accountability.  The  Act  obligates  organizations, including State agencies, involved in digital personal data processing, to implement robust technical and  organisational  measures,  including  obtaining  consent  from  the  individual  with  the  option  to access the notice in English or any language specified in the Eighth Schedule to the Constitution and the purpose for which it is proposed to be processed along with the link or the manner to access her rights for specified purposes before processing of her digital personal data. The individual shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given. Further, the Act allows that the State and any of its instrumentalities  may  process  digital  personal  data  of  an  individual  to  provide  her  the  subsidy, benefit, service, certificate, licence or permit where she has previously consented to the processing of her digital personal data for such purposes subject to standards given in the Rule 5 of the Draft Digital  Personal  Data  Protection  Rules,  2025.  Moreover,  the  Act  empowers  individuals  with  the rights  to  access,  correct,  and  erase  her  digital  personal  data,  enhancing  transparency  about processing and usage of her personal data. The individuals have a right to grievance redressal which ensures  to  address  any  concerns  about  her  personal  data  processing.  The  grievance  redressal mechanism and adjudication  process  of  the  Data  Protection  Board  with  the  penalty  enforcement mechanism further strengthens the oversight and accountability frameworks. The Act appropriately balances the rights of individuals and the obligations of the Data Fiduciaries.

*******