Author: Asif Khan, B.A.LLB, 3 rd Year, Jyotirmoy School of Law

“What if the very law meant to protect your privacy ends up protecting those in power instead? The Digital Personal Data Protection Act, 2023, promises safety but whispers of secrecy.”

In an era where our lives are increasingly digitized—from banking and shopping to healthcare and education—personal data has emerged as the new oil. Every click we make, every form we fill, every transaction we authorize leaves behind a traceable footprint. Recognizing the sheer scale of this digital trail, the Indian government introduced the Digital Personal Data Protection (DPDP) Act, 2023, presenting it as a milestone in safeguarding citizens’ privacy.

On the surface, it sounds like the long-awaited step India needed after years of debate on data protection. But when examined closely, the act feels less like a protective shield and more like a sharpened tool for the state to consolidate power. Far from empowering citizens, it raises questions on whether the balance of transparency, liberty, and accountability in India’s
democracy is quietly tilting in the wrong direction.

The Hidden Collision: DPDP vs RTI

The most troubling fault line lies in the way the DPDP Act collides with the much older and deeply respected Right to Information (RTI) Act, 2005. The RTI Act transformed Indian democracy at a grassroots level. Ordinary citizens—from farmers in rural Rajasthan to students in Chennai—could demand answers from government departments. Think of examples: villagers exposing ghost beneficiaries of ration or MGNREGA schemes, activists uncovering hidden loan defaults of influential corporations, or citizens demanding records of assets declared by senior bureaucrats. These were not abstract exercises in democracy—they were real checks on corruption, nepotism, and arbitrary power.

Now enters the DPDP Act, which shields “personal information” from disclosure. Of course, privacy is important. But in this new legal regime, even data that has clear public relevance—like the names of willful loan defaulters, beneficiaries under government subsidy schemes, or details of a minister’s discretionary spending—can be stonewalled by labeling it personal data. What used to be a tool for empowering citizens begins to look like a state- sanctioned vault of secrecy. Critics argue, and rightly so, that this exemption undermines the essence of RTI. It is not about denying gossip-seekers access to private details. It is about shielding officials and institutions from scrutiny, effectively allowing those in power to decide what the public should or should not know. Over time, this weakens a democratic culture where information is meant to flow freely in the public interest.

The Government’s Exemptions: A Surveillance Blank Cheque?

Another glaring concern is the broad umbrella of exemptions provided to the state. Private companies are subject to tight obligations under the DPDP Act: secure storage, rules of consent, penalties for breaches, and so on. Ironically, the biggest custodian of citizens’ data—the government—is largely free to bypass these checks in the name of “public order,”
“national security,” or “public interest.” On paper, this may seem justifiable. Every nation needs certain flexibilities to deal with
threats or emergencies. However, the problem is not in the presence of exemptions but in their scope and vagueness. The act does not clearly define what constitutes “public interest.” Will it include surveillance of online dissent? Scrutiny of political opponents? Or the large- scale monitoring of citizens’ financial activities in the name of curbing black money? The result is a structure where citizens and private firms walk on eggshells while the state enjoys free rein. This isn’t speculation—it echoes global experiences. Look at how China’s digital governance infrastructure enabled mass surveillance under the banner of security. Even in democratic societies, surveillance overreach has sparked outrage, like when Edward Snowden revealed mass spying by US intelligence agencies 2 . Without strong checks, India risks sleepwalking into a surveillance-oriented governance model.

Missing Fundamental Rights or The Case of Probability

For years, international frameworks like the EU’s General Data Protection Regulation (GDPR) have recognized individual empowerment as central to data protection. In such models, citizens are not passive subjects of state or corporate data handling—they are consumers with agency. One important right often cited is the Right to Data Portability. If a user wants to switch from one platform to another—say, from one fintech app to its competitor—they should be able to carry their data in a usable format. This allows them both freedom of choice and leverage over service providers. Shockingly, the DPDP Act omits this right altogether. Why does this omission matter? Because in a world increasingly dominated by digital oligopolies—be it large e-commerce platforms, banks, or telecom giants—users without portability are tethered to monopolies. The absence of this right silently increases citizens’ dependence on both corporations and the state, reducing their bargaining power in India’s digital economy.

Everyday Impact: The Grassroots Perspective

Looking beyond technical critiques, a pressing concern arises: what does the Digital Personal Data Protection Act truly signify for the daily lives of ordinary Indians? Imagine a woman in a village trying to verify whether she has rightfully received her pension. Previously, she could use the Right to Information Act to request a list of approved beneficiaries and verify the fairness of the process. With DPDP now in force, such requests may be routinely rejected, citing protection of personal data, even if public accountability suffers as a result. Consider also local reporters who, armed with RTI, have historically exposed financial frauds
in small towns. For them, the DPDP’s new restrictions aren’t just another regulatory barrier—they represent a potential shutdown of grassroots journalism. When “privacy” is used to block legitimate scrutiny in the public interest, it’s the voices of communities that are silenced, and power is shielded from accountability.

Global Standards: How Does India Compare?

Around the world, leading data protection laws strive for equilibrium. The EU’s GDPR sets the gold standard for privacy, yet maintains strong exceptions ensuring public records and government dealings remain accessible in the interest of transparency. Brazil’s LGPD and South Africa’s POPI Act equally promote openness alongside data protection, embedding constitutional values of access to information into their frameworks. India’s approach, by contrast, appears to tilt heavily toward expanded government discretion. The DPDP Act, in its current form, risks aligning India closer to nations with restrictive data regimes, potentially weakening the foundations of its democratic narrative and digital leadership.

What’s At Stake for Citizens!

Eroding the RTI’s scope, granting government agencies substantial leeway, and omitting vital user-centric rights such as data portability all translate to a significant loss for the average citizen. Mechanisms that allowed people to contest injustice and demand answers from authorities are being stripped away. The effect is clear: the authorities accrue greater surveillance capabilities, while citizens lose meaningful access to public information. This imbalance does more than diminish transparency—it incubates corruption, entrenches social divides, and discourages louder’s. Ultimately, it corrodes the very trust that underpins
democratic governance.

Why Reform is Imperative?

Critiques of DPDP should not be dismissed as mere academic hand-wringing or activist hyperbole. The RTI itself was born through the relentless efforts of grassroots movements—citizens driven by the desire for honest governance and accountability. History affirms the necessity of vigilance.

Today, there’s a clear need for a robust public campaign to demand:
 Tight limits on government exemptions.
 Reconciliation of DPDP with the RTI to preserve public access to information.
 Integration of user rights, such as correcting, erasing, or transferring personal data.
 Establishment of strong independent oversight, insulated from direct government influence.
 Without these safeguards, digital progress risks leaving democracy behind.

Conclusion: Between Privacy and Power

The Digital Personal Data Protection Act, 2023 is presented as India’s leap forward into the digital future. But stripped of the jargon and gloss, its current structure feels less like a shield for citizens’ privacy and more like a fortress for state control. By undermining transparency under RTI, granting sweeping exemptions to government agencies, and ignoring key rights enjoyed elsewhere, the act paints a troubling picture. Framed as a leap into the digital age, the DPDP Act often serves more as a tool for governmental control than as a true safeguard for public privacy. Weakening transparency, ignoring international norms, and disregarding core citizen rights—all point to a troubling shift.

Democratic systems rely on mutual trust and accountability: the state must remain answerable to its people. If this regulatory trajectory continues, it may establish a one-way mirror where authority is unchecked and citizens are left in the dark.
India’s digital destiny now hinges on critical choices. Will the next chapter reflect real democratic empowerment, or will privacy become the mask that conceals unchecked state power? The answer demands urgent, collective action.

“Privacy without transparency is not freedom—it is control. The true test of the DPDP Act is whether it serves the citizen or subdues them. In that answer lies the future of Indian democracy.”