Custody Before Consent: The Digital Personal Data Protection Act, 2023 and the Data Held by India's Critical-Sector Operators

B.A.P-I Retrospective, 2020 to 2024. This paper looks back at 2023 and the lesson it holds for the protection of India's critical infrastructure.

1. Introduction

August 2023 gave India its first general law on the protection of digital personal data. The Digital Personal Data Protection Bill cleared the Rajya Sabha on 9 August after its passage in the Lok Sabha, with the Minister for Electronics and Information Technology noting that it followed "a lot of detailed consultations with stakeholders" and had been drafted so that "the common man can understand the provisions" (All India Radio, 2023, Aug. 9). The President gave assent on 11 August 2023 (SCC Online, 2023, Aug. 12).

This paper reads it from one particular angle. The question is less about privacy as a civil liberty than about custody: what the Act asks of organisations that hold personal data, how that sits beside India's existing cyber security machinery under CERT-In and the National Critical Information Infrastructure Protection Centre (NCIIPC), and what it means for operators of power, banking, health, telecom and transport services. One finds that a consent statute has also become, by design, a security statute, and that it gives India a third institutional pillar beside CERT-In and the NCIIPC.

2. What the Act Asks of Data Fiduciaries

The Act builds its obligations around the data fiduciary, defined as any person who alone or with others "determines the purpose and means of processing of personal data" (Government of India, 2023, Aug. 11). Consent must be free, specific, informed, unconditional and unambiguous, and fiduciaries must keep data accurate and provide grievance redressal (SCC Online, 2023, Aug. 12).

For so far as infrastructure security is concerned, three provisions of Section 8 carry the weight. A fiduciary must protect personal data in its possession or under its control "by taking reasonable security safeguards to prevent personal data breach"; in the event of a breach it must give intimation to the Data Protection Board and to each affected Data Principal; and it must erase personal data once consent is withdrawn or once the specified purpose is no longer being served (Government of India, 2023, Aug. 11). The erasure duty deserves more attention than it has received.

Section 10 then creates the category of Significant Data Fiduciary. The government may notify an entity as significant on factors that expressly include potential impact on the sovereignty and integrity of India, security of the State and public order; such an entity must appoint a Data Protection Officer based in India, appoint an independent data auditor and undertake periodic Data Protection Impact Assessments and audits (Government of India, 2023, Aug. 11). The penalty schedule makes the priorities plain. Failure to maintain reasonable security safeguards attracts a penalty of up to Rs 250 crore, failure to notify a breach or to meet the obligations concerning children up to Rs 200 crore, and other violations up to Rs 50 crore (PIB, 2025, Nov. 17). The heaviest sanction in the statute, in other words, is reserved not for misuse of consent but for poor security.

3. Beside CERT-In and NCIIPC: Three Regimes, One Incident

The Act did not arrive in an empty field. Section 70A of the Information Technology Act, inserted by the 2008 amendments, allows systems to be declared critical information infrastructure, and the NCIIPC was formally created through a gazette notification in January 2014 to protect those facilities "whose incapacity or destruction would cause a debilitating impact" on national security, governance, the economy and social well-being, across sectors such as power and energy, banking and insurance, telecommunications, transport and strategic public enterprises (Datta, 2016, Nov. 3). Non-critical systems fall to CERT-In under Section 70B, and CERT-In's directions of 28 April 2022 require cyber incidents to be reported "within 6 hours of noticing" them and ICT systems to be synchronised to time sources consistent with those of the National Physical Laboratory and the National Informatics Centre (CERT-In, 2022, May).

The DPDP Act states that its provisions are "in addition to and not in derogation of" any other law, while also providing that it shall prevail to the extent of any conflict (Government of India, 2023, Aug. 11). That is a sound principle of layered protection, and it invites one further step of coordination. A ransomware attack on a hospital or a utility that exposes customer records is at once a cyber incident reportable to CERT-In within hours, possibly an incident affecting a protected system of interest to the NCIIPC, and a personal data breach reportable to the Board and to every affected individual. The Rules require the fiduciary to give the Board a detailed report within 72 hours (SCC Online, 2025, Nov. 14). Three clocks, three recipients and three vocabularies can now run on a single event. Harmonising them is the natural next stage of a reform that CERT-In's 2022 directions began.

The ransomware attack on the All India Institute of Medical Sciences in late 2022, in which, according to the Minister of State for IT, five servers were affected and about 1.3 TB of data was encrypted (Deccan Herald, 2022, Dec. 16), and which AIIMS reported to CERT-In for evaluation, shows why this matters. A hospital is a critical service, a custodian of some of the most sensitive personal data in the country and a networked enterprise all at once. Treating these as three separate compliance problems creates institutional seams, and closing such seams is precisely what an integrated internal security and infrastructure protection architecture is meant to achieve (Dash, 2021, Jan. 22).

4. The Rules and the Long Road to Commencement

The Act was framework legislation and much of its operative detail was deferred to Rules. These were notified in November 2025, more than two years after assent, together with a schedule of staggered commencement (Government of India, 2023, Aug. 11). Rules 1, 2 and 17 to 21, which concern the Board, came into force at once; Rule 4 on the registration of Consent Managers takes effect after one year, on 13 November 2026; and Rules 3, 5 to 16, 22 and 23, which carry the substantive obligations, take effect after eighteen months, on 13 May 2027 (SCC Online, 2025, Nov. 14).

The security content of the Rules is more specific than the Act. Rule 6 expects encryption, masking or tokenisation of data, access controls, logging and monitoring for unauthorised access, backup measures for continuity, retention of logs and personal data for one year, and contracts that bind data processors to maintain safeguards (SCC Online, 2025, Nov. 14). Affected individuals must be told of a breach without delay and in plain language, including what happened, its likely impact and what has been done about it (PIB, 2025, Nov. 17). These are sound baseline controls. For operators that have already invested under CERT-In's directions and sectoral regulation, compliance by 2027 builds on controls already in place rather than starting afresh.

5. What It Means for Critical-Sector Operators

For critical-sector operators the Act matters in three ways. First, customer and employee data held by these operators is now a regulated asset whose loss carries a quantifiable penalty. Second, the Significant Data Fiduciary category, with its explicit reference to the security of the State and public order, gives the government a ready instrument to bring large infrastructure operators under audit and impact-assessment duties, and the PIB explainer notes that such fiduciaries must follow government directions on restricted categories of data, including local storage where required (PIB, 2025, Nov. 17). Third, Section 16 allows the government to restrict the transfer of personal data to notified countries or territories outside India (Government of India, 2023, Aug. 11), a power that bears directly on operators who run billing, customer service or analytics on foreign cloud infrastructure.

The Act's scope is deliberately focused. It protects personal data, not operational data. The telemetry of a grid substation, the signalling logs of a railway or the SCADA configuration of a water works are outside it unless they identify individuals. Section 17(2)(a) also allows the government to exempt notified instrumentalities of the State in the interests of sovereignty, security and public order (Government of India, 2023, Aug. 11), preserving for the State the flexibility that national security requires. Operational data, the data that keeps the lights on, rightly remains the province of CERT-In, the NCIIPC and the sectoral regulators, which is why coordination among them matters so much.

6. Recommendation: Join the Clocks and Name the Critical Fiduciaries

What comes through from all of this is that the DPDP Act has given India a capable instrument for data custody, and that India now has, in CERT-In, the NCIIPC and the Data Protection Board, the three institutions that a mature data security system requires. Two steps would bind them into one coherent protection architecture before the substantive Rules bite in May 2027. The first is a single incident intake, so that one report from an operator satisfies CERT-In, the NCIIPC and the Data Protection Board, with each authority taking what it needs from a common record. The second is a deliberate, published policy of notifying operators of designated critical information infrastructure as Significant Data Fiduciaries, so that audit and impact-assessment duties fall where national exposure is greatest.

Both steps belong within a national resilience framework under the National Security Council that treats data custody, cyber incident response and physical continuity as dimensions of one problem rather than three (Dash, 2025, Jan. 30). Keeping this into consideration, the Act should be read not as the end of India's data governance story but as one statute that a future Critical Infrastructure Protection Act will need to absorb and coordinate.