Parliament Question: Data Protection under Digital India Programme

GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY LOK SABHA UNSTARRED QUESTION NO. 4330 TO BE ANSWERED ON: 18.03.2026 DATA PROTECTION UNDER DIGITAL INDIA PROGRAMME † 4330. SMT. GENIBEN NAGAJI THAKOR: Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state: (a) whether the Government has assessed the current status of digital services, cyber security and data protection in the country; (b) if so, the key findings thereof; (c) whether the Government proposes to bring any new policy/law to ensure data protection under Digital India Programme; and (d) if so, the steps taken by the Government so far in this regard? ANSWER MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA) (a) to (d): The Government has taken several steps to strengthen the framework for digital services, cyber security and data protection in the country. The Digital Personal Data Protection Act, 2023 (“Act”) establishes a comprehensive framework governing the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes. Under the Act, personal data may be processed only for a lawful purpose and either on the basis of the consent of the Data Principal or for certain legitimate uses. Consent is required to be free, specific, informed, unconditional and unambiguous, and must be accompanied or preceded by a notice describing the personal data to be collected and the purpose of its processing. To operationalise the provisions of the Act, the Government has notified the Digital Personal Data Protection Rules, 2025, (“Rules”) which establish detailed mechanisms for the implementation of the Act, including requirements relating to consent notices, reasonable security safeguards, breach notification, and the protection of the rights of Data Principals. The framework created by the Act and the Rules places obligations on Data Fiduciaries to implement appropriate technical and organisational measures to protect digital personal data and prevent personal data breaches. In the event of a personal data breach, the Data Fiduciary is required to notify the Data Protection Board of India as well as the affected Data Principals in the prescribed manner.The Act also provides for the establishment of the Data Protection Board of India, which is empowered to inquire into personal data breaches, ensure compliance with the provisions of the Act, and take appropriate action in cases of non-compliance. Accordingly, through the enactment of the Act and the notification of the Rules, the Government has established a comprehensive and citizen-centric framework to ensure the protection of digital personal data and to promote responsible use of data in India’s digital ecosystem. ******