Lok Sabha Question No. 2776 (UNSTARRED), answered on 2025-12-17
Subject: Increase of Data Secrecy Concern
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Shri Ummeda Ram Beniwal

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 2776

TO BE ANSWERED ON: 17.12.2025

## INCREASE OF DATA SECRECY CONCERN

## †2776.  SHRI UMMEDA RAM BENIWAL:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether data secrecy concerns have increased after the Implementation of new Digital Personal Data Protection Act;
- (b) if so, the safety measures taken in this regard; and
- (c) whether the Government has ensured transparency in data collection by the public agencies and if so, the details thereof?

## ANSWER

MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a) to (c): The Digital Personal Data Protection Act, 2023 ('Act') provides for the processing of digital personal data in a manner that recognises both the rights of the individual to protect their personal data and the need to process such personal data for lawful purposes.

## Key features of Act

The Act requires all Data Fiduciaries to ensure lawful processing of personal data. It lays down clear obligations relating to transparency, purpose limitation, data minimization, accuracy, security safeguards and respect for the rights of Data Principals.

## Notification of Act and Rules

The  Act,  and  the  Digital  Personal  Data  Protection  Ru    les ,  2025  ('Rules')  notified  on  13 November, 2025 provide a timeline for phased implementation of its provisions over an eighteenmonth transition  period,  including  the  establishment  of  the  Data  Protection  Board.  The  Rules specify the following implementation timelines:

- Phase 1: Establishment and operationalisation of the Data Protection Board of India
- Phase 2 (within one year): Registration and functioning of Consent Managers
- Phase 3 (within eighteen months): Compliance obligations for Data Fiduciaries including data principal rights, security safeguards and breach notification.

It  requires  Data  Fiduciaries to  implement strong  security safeguards, erase personal data upon withdrawal  of  consent  (unless  retention  is  legally  required),  and  comply  within  the  transition period.

The  Rules  further  require  Data  Fiduciaries  to  adopt  appropriate  technical  and  organizational safeguards, such as encryption or masking, to protect personal data and prevent breaches. The Act envisages the Data Protection Board to address violations of the Act. It can investigate breaches, issue corrective directions, and impose penalties. Penalties are to be determined based on factors like nature of breach, harm caused, safeguards in place, severity and recurrence.

In the event of a personal data breach, Data Fiduciaries are required to promptly notify the affected Data Principals and the Data Protection Board of India. Upon receipt of breach intimation, the Data Protection Board may conduct an inquiry and impose monetary penalties in accordance with the Act.

The Board is empowered to investigate breaches, issue corrective directions, and impose penalties up to ₹250 crore, taking into account factors like nature of breach, harm caused, safeguards in place, severity and recurrence.

The Government is ensuring widespread awareness and adoption of the DPDP Act by educating citizens on their rights and responsibilities. Capacity-building initiatives, including workshops, conferences, expert sessions, and digital outreach campaigns are also being undertaken.

*****