Lok Sabha Question No. 3096 (UNSTARRED), answered on 2025-03-19
Subject: Use of WhatsApp for delivery of Citizen Services
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Shri Maddila Gurumoorthy

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION. NO. 3096

TO BE ANSWERED ON: 19.03.2025

## USE OF WHATSAPP FOR DELIVERY OF CITIZEN SERVICES

## 3096. SHRI MADDILA GURUMOORTHY:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether the transmission of personal data of Indian citizens through the servers of WhatsApp, a service provider with servers based abroad, is legally compliant;
- (b) whether the Government of Andhra Pradesh requires the permission of the Union Government for integrating a foreign-based  service  provider,  like  WhatsApp,  in  activities  involving  the transmission  of  personal  data  of  citizens  and  if  so,  whether  the  Government  of  Andhra  Pradesh obtained such approvals;
- (c) whether it is true that USA authorities have laws allowing them to requisition data from Meta
- (Facebook) and WhatsApp even if these platforms provide end-to-end encryption services; and
- (d) the measures being taken by the Union Government to ensure the protection of personal data of Indian citizens being transmitted through foreign-based platforms such as WhatsApp in governancerelated services?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a) to  (d):    The  policies  of  the  Government  of  India  are  aimed  at  ensuring  an  open,  safe, trusted and accountable cyberspace for the users of the country. The Government has enacted the  Information  Technology  Act,  2000  (IT  Act)  and  Digital  Personal  Data  Protection  Act, 2023  ('DPDP  Act')  and  has  notified  the  Information  Technology  (Reasonable  Security Practices  and  Procedures  and  Sensitive  Personal  Data  or  Information)  Rules,  2011  ('SPDI Rules') under IT Act to address data protection concerns.

Furthermore, the SPDI Rules state that a body corporate may transmit individual sensitive personal data or information to any other body corporate or a person in or outside India that provides the same degree of data protection that only when it is required for the fulfilment of the contract or when the individual has given her consent.

The Government of Andhra Pradesh has informed that the WhatsApp messaging service has been integrated for the purpose of providing civic services to citizens. The personal data of the individuals is being stored on the local servers as per the mutual contractual agreements. Further,  the  DPDP  Act  establishes  the  legal  framework  for  data  protection  and  mandates Data Fiduciaries to implement security safeguards as well as robust technical and organisational measures while processing the digital personal data. Under the DPDP Act, the Central  Government  may,  by  notification,  restrict  the  transfer  of  personal  data  by  a  Data Fiduciary  for  processing  personal  data  to  any  other  country  or  territory  outside  India.  In addition,  Data  Fiduciaries  shall  also  abide  by  any  higher  protection  or  restriction  on  data transfer that may be applicable under any other law.

******