Suvarna Mandal & Mohamed Thahir Sulaiman

Abstract: India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 seek to support India’s role in the global digital economy. However, the framework remains executive-centric. The Central Government has significant control over the Data Protection Board, broad powers to call for information, and wide powers to exempt State instrumentalities on grounds including national security.

This creates a tension in India’s digital policy. The DPDPA keeps control over personal data with the government, even as India increasingly supports digital trade and cross-border data flows. Its broad executive powers, limited institutional independence and safeguards for data transfers that have not yet been notified may complicate foreign adequacy assessments and transfer risk analyses. The framework may therefore enable cross-border data flows in principle, while creating uncertainty for businesses and regulators assessing whether India provides sufficiently reliable and independent privacy protections.the need of the hour.

With the enactment of the Digital Personal Data Protection Rules, 2025 (the Rules), the framework under the Digital Personal Data Protection Act, 2023 (DPDPA) has been finally notified and placed on a staggered path to operationalisation. In doing so, the notification marks the culmination of more than a decade of policy and legislative evolution, from the A P Shah Committee and the Justice B N Srikrishna Committee process to the Supreme Court’s recognition of the right to privacy in K.S. Puttaswamy v. Union of India. The DPDPA and the Rules, although notified, have staggered implementation timelines, leading to the phased operationalisation of the new framework by 13^th May 2027.

This new data protection framework has resulted in a regulatory regime that is formally structured around a consent-driven model governing the collection, storage, and processing of digital personal data. At the same time, it is also characterised by significant executive control, with wide discretionary powers and significant exemptions vested in the Central Government.

However, with India’s recent push to foster and expand its participation in global digital trade, particularly through commitments on cross-border data flows in ongoing free trade negotiations, the DPDPA faces the additional challenge of enabling such transfers while maintaining appropriate safeguards and restrictions. In this context, the DPDPA framework appears increasingly misaligned with India’s external ambitions, with provisions governing data transfers, regulatory certainty, and institutional independence assuming significance.

Against this backdrop, this article argues that the executive-driven framework under the DPDPA is increasingly inadequate and unsuitable in light of India’s evolving global trade ambitions. It firsly examines the DPDPA and the Rules to highlight their executive-driven nature; secondly, it traces India’s recent shift away from data localisation and towards facilitating cross-border data flows through digital trade provisions in free trade agreements; and thirdly, it highlights the resulting incoherence between India’s domestic policy framework and its international trade ambitions. In doing so, this article seeks to bridge and analyse two distinct but interconnected policy realms whose interrelationship is not yet adequately understood within existing literature on the DPDPA framework: India’s digital privacy regime and its digital trade ambitions.

I – Executive-Centred Architecture of the DPDPA

The DPDPA was enacted to provide a framework for the protection of personal data, as well as for its processing for lawful purposes. Reflecting this dual object, and while drawing on the work of the Justice B N Srikrishna Committee Report, the DPDPA adopts a consent-centric vocabulary of notice, rights and fiduciary duties. However, it departs materially from the General Data Protection Regulation (GDPR) of the European Union (EU). In particular, it provides for narrower lawful bases for processing, does not recognize a separate category of sensitive personal data category, grants broader State exemptions, and establishes an executive-controlled regulator.

This orientation is reflected in the structure of the Act. Section 4 lays down the foundational grounds for processing personal data, anchoring it primarily in consent and certain legitimate uses. Sections 5 and 6 operationalise the framework of consent-based processing by requiring notice and mandating that consent be free, specific, informed, and unambiguous. Section 8 imposes general obligations on data fiduciaries, including duties relating to accuracy, security safeguards, and purpose-linked processing. Further, Sections 11 to 14 of Chapter III of the DPDPA enumerates the rights of the data principal, including the right to access information, seek correction and erasure, and pursue grievance redressal, while Rule 14 prescribes the manner in which such rights and grievances may be exercised. These provisions thus seek to operationalise dignity within the digital domain by ensuring that individuals retain control over their personal data.

However, at the same time, the DPDPA framework is also accompanied by a significant departure from the rights-based structure usually associated with comprehensive data protection regimes because substantive control remains concentrated with the executive. In a standard rights-based architecture, data protection is anchored in individual autonomy and fundamental rights, offering expansive, enforceable guarantees alongside a genuinely independent supervisory authority capable of checking both corporate and state power. Furthermore, state exemptions and access to personal data in such regimes are strictly constrained by principles of necessity, proportionality, and independent judicial oversight, as seen in EU’s GDPR framework. Under the DPDPA, however, this paradigm is disrupted because substantive control remains concentrated with the executive. This departure is manifested in at least three key aspects.

First, the institutional design of the Data Protection Board of India (DPBI) as constituted under Section 18 raises concerns regarding independence. With its composition and qualifications determined under Section 19, the Board is entirely appointed by the Central Government, which also retains the authority to notify the number of members and prescribe eligibility criteria. Rule 17 further provides for a Search-cum-Selection Committee comprising of senior government officials and two experts nominated by the Central Government, thereby preserving effective executive control over appointments. This contrasts with rights-based structures, where such a selection panel is deliberately designed to prevent unilateral executive dominance through multi-branch representation to ensure independence, rather than relying exclusively on senior bureaucrats and government nominees alone. The concern, therefore, is not only appointment by the Central Government, but also whether the Board can be perceived as institutionally independent when it may have to adjudicate complaints involving State instrumentalities and government processing. This design thus positions the DPBI less as an independent regulatory authority akin to a “fourth branch” institution, and more as an extension of the executive, thereby limiting its capacity to function as an autonomous adjudicatory body.

Second, the DPDPA and the Rules also confer expansive and largely unfettered powers on the executive to call for information. Section 36 authorises the Central Government to require the Board, any data fiduciary, or intermediary to furnish such information “as it may call for,” without prescribing effective limits. Similar language is replicated in Rule 4(6) with respect to consent managers. Rule 23, read with the Seventh Schedule, operationalises Section 36 by empowering the government, acting through authorised persons under the Seventh Schedule, to demand information for broadly defined purposes. These purposes include “interests of sovereignty and integrity of India”, “security of the State”, and for the performance of any function under law in force. Although expressions such as “security of the State” and the “sovereignty and integrity” of India appear in several Indian statutes, the courts have generally interpreted them broadly and have accorded the executive substantial discretion in determining when these interests are implicated. Thus, given the vagueness of these grounds, coupled with the absence of procedural safeguards or standards, these provisions raise serious concerns regarding the potential for overreach. Also, where such broad expressions are left to executive application without specific procedural thresholds prescribed in the legislation, they may encourage expansive interpretation by the executive and authorised officers, leaving the limits of those powers to be tested through ex post litigation.

Third, the DPDPA also incorporates broadly worded exemptions and ambiguous provisions that tilt the framework in favour of the executive. For instance, Section 17(2) enables the Central Government to exempt any instrumentality of the State from the application of the      Act on grounds such as sovereignty, security, public order, and friendly relations with foreign states. Given the general tendency of courts to interpret similar grounds in other statutory regimes broadly, the fact that these terms remain undefined and open-ended permits an expansive interpretation. Undefined exemption grounds can invite broad executive or administrative interpretation, requiring affected parties to litigate the boundaries of the exemption after data has already been excluded from the Act’s safeguards. Similarly, while Rule 8(1) mandates the erasure of personal data upon fulfilment of purpose, Rule 8(3) requires retention of personal data, associated traffic data and other logs for at least one year for the purposes specified in the Seventh Schedule, even though traffic data is not clearly defined. Read alongside the broad powers to call for information, this creates the risk of State access to retained communication metadata without sufficiently granular safeguards.

Additionally, Section 44(3) introduces amendments that significantly dilute the framework under the Right to Information Act, 2005 (RTI Act), further reflecting a shift toward state-centric control over information flows. This is seen in the amendments to Section 8(1)(j) of the RTI Act that imposes a blanket exemption on the disclosure of all “personal information,” eliminating the crucial statutory balancing test that previously permitted disclosure if public interest outweighed personal privacy. This is significant as removing the public interest exception effectively shields public officials, bureaucratic actions, and state spending from civic scrutiny, thereby weakening a primary instrument of democratic accountability in favour of institutional opacity.

While such features may ostensibly be justified on the basis of preserving digital sovereignty, which ensures that the Indian state retains control over data and its governance, the cumulative effect of these provisions is a state-centric architecture with weak procedural safeguards and the possibility of executive overreach. As a result, this state-centric architecture of the DPDP Act regime, characterized by broad executive exemptions, extensive state power to compel data disclosure, and regulatory bodies that function under administrative control rather than operating with independent oversight raise the possibility of governmental authority and state interests being prioritised over individual autonomy and privacy.

II – India’s Shift towards Digital Trade

With the DPDPA’s Statement of Objects and Reasons recognising that the protection of personal data is a precondition for the growth of the digital economy, it must be remembered that this analysis of the DPDPA is crucial, not only for understanding privacy regulation in India, but also for India’s role in the emerging global digital economy, where access to and control over data increasingly determine relative market power.

Having recognised the interconnection between data governance and digital trade, the DPDPA thus assumes a second purpose in facilitating India’s digital trade policy. For this, it is first necessary to examine India’s shifting stance towards digital trade.

While early efforts to regulate digital trade and to promote a free and open international digital market had begun at the multilateral level, particularly following the WTO Declaration on Global Electronic Commerce, India, along with several other developing countries, responded cautiously. This hesitation stemmed from concerns surrounding both digital colonialism, whereby data generated in developing economies could be extracted and controlled by technologically advanced jurisdictions, as well as the need to maintain India’s digital sovereignty, as mentioned earlier.

In response, India thus adopted a protectionist stance, favouring data localisation measures and restrictions on cross-border transfers. This approach can be seen in the Draft Personal Data Protection Bill, 2018, with Section 40 mandating data localisation requirements to be undertaken by every data fiduciary, which entails the mandatory storing of data within the territorial boundaries of the country. This position was also evident in India’s refusal to undertake binding commitments in multilateral trade agreements such as the Regional Comprehensive Economic Partnership (RCEP), due to provisions like Articles 2.14(2) and 12.15(2), which sought to prohibit localisation requirements and ensure the free flow of data across borders.         

     However, in recent years, along with the broader policy shift towards trade liberalisation through free trade agreements, India has also undergone a marked shift in its approach to the global digital economy. Rather than insulating its digital market, it has increasingly sought to foster and expand its participation through bilateral and plurilateral free trade agreements with select countries. This transition is reflected, in part, in the final design of the DPDPA. Section 16 permits personal data transfers outside India, subject to restrictions that may be notified by the Central Government. Rule 15 separately contemplates government-specified requirements for making personal data available to a foreign State, or persons or entities under its control or agency, so the transfer regime is not only a country-restriction mechanism but also retains a discretionary executive layer. This design has been described as a more permissive “negative list” approach. This marks a clear departure from the earlier, more protectionist framework envisaged under the 2018 Draft Bill.

This evolving stance is also reflected in India’s recent trade engagements. For instance, the Comprehensive Economic Partnership Agreement with the United Arab Emirates incorporates provisions allowing cross-border flows of information, albeit subject to domestic regulatory frameworks as seen in Article 9.11. Similarly, Chapter 10 of the Comprehensive Economic Cooperation Agreement with Singapore includes e-commerce provisions that, while limited, facilitate digital trade.

Some recent agreements, however, go further still. The Comprehensive Economic and Trade Agreement with the United Kingdom includes even wider digital trade provisions with Article 12.12 granting equal and non-discriminatory access to open government data, and Article 12.15 prohibiting the disclosure of source code. With negotiations on the EU trade deal coming to a close, similar expansive provisions are expected to be incorporated.

III – EU Transfer Assessments, Adequacy Thresholds and the DPDPA

Given recent criticism regarding India’s efforts to expand digital trade at the expense of its digital sovereignty, it must be remembered that the DPDPA serves a two-fold purpose in facilitating digital trade. While the first purpose of providing a protective framework to prevent wrongful access, processing, and control of personal data is well known, it also serves an enabling function for cross-border data transfers. The relevant question is not only whether India is formally seeking an EU adequacy decision for enhancing bilateral digital trade with the EU, but whether EU exporters conducting transfer assessments can treat the Indian legal framework as preserving an essentially equivalent level of protection. In this regard, the executive-controlled nature of the DPDPA regime creates friction with India’s international trade ambitions of becoming a major player in the global digital market.

While the inadequacy of the DPDPA’s protective framework has been discussed earlier in this article, it also has significant implications for meeting these threshold requirements. This can be better understood by examining Articles 45 and 46 of the GDPR.

Article 45 provides that transfers of personal data outside the EU may only take place where the third country ensures an adequate level of protection, equivalent in substance to that guaranteed within the EU. Such an adequacy determination is made after considering factors including the rule of law, the existence of effectively enforceable rights for data subjects under domestic law, and the presence of independent supervisory authorities responsible for ensuring compliance and enforcement. In the absence of an adequacy decision, Article 46 permits transfers only where appropriate safeguards have been implemented, such as standard contractual clauses or ad hoc contractual arrangements. In such cases, a Transfer Risk Assessment (TRA) must be undertaken, requiring the transferor to demonstrate that the legal framework of the transferee country does not undermine these safeguards. This includes examining the scope of government surveillance and national security access powers, as well as the availability of effective legal remedies.

When the DPDPA is examined in light of the adequacy requirements and the TRA, its inadequacies become quite apparent. While the statute’s substantive data protection principles only partially align with the standards set under the GDPR, the undermining of the independence and functioning of the DPBI, the extensive powers granted to the government to requisition information from data fiduciaries, intermediaries, and consent managers, and the breadth of exemptions provided in favour of the State collectively suggest that India may present difficulties for adequacy-style analysis and for case-by-case transfer risk assessments.

The wider statutory landscape may further compound this analysis. For instance, Rule 3 of the Interception Rules, 2009, issued under Section 69 of the Information Technology Act, 2000, permits government agencies to intercept, monitor, or decrypt information generated, transmitted, received, or stored in a computer resource on grounds such as the defence of India, sovereignty and integrity, and public order. Similarly, Rule 3(1)(i) of the Intermediary Rules, 2011, requires intermediaries to provide information in their control or possession to government agencies for verification. Additionally, Section 94 of the Bharatiya Nagarik Suraksha Sanhita 2023 empowers the police to require the production of electronic communications deemed necessary or desirable for the purposes of any investigation, inquiry, trial, or other proceeding under the Act. Taken together, these provisions indicate that, even outside the DPDPA framework, the executive retains broad and open-ended powers to access data.

Indeed, after considering the relevant factors, the European Data Protection Supervisor, in 2024, denied a request by the European Investment Bank (“EIB”) to transfer contact details to Brazil, Türkiye, India and Fiji, finding that the EIB had not provided sufficient evidence that those countries ensured an “essentially equivalent” level of data protection. The EDPS nevertheless recommended considering the use of available derogations for transfers that are limited and occasional in nature.

Finally, it is worth noting that although the DPDPA provides for procedural safeguards governing cross-border data transfers, these requirements remain to be specified. While Rule 15 contemplates that personal data transferred outside India must comply with requirements specified by the Central Government, no such requirements or restrictions have been notified to date. Given the staggered commencement of Rule 15, this may reflect sequencing, but it still creates interim uncertainty for businesses and foreign transferors.

Therefore, to conclude, while trade agreements may formally include provisions on digital trade, their practical operation ultimately depends on whether such transfers satisfy the domestic legal requirements of the receiving jurisdiction and exporters’ transfer assessments. In this context, India’s current executive-centric framework presents a significant hurdle to its ambitions in the global digital trade ecosystem.

Suvarna Mandal is a Partner at Saikrishna & Associates and leads its data protection practice. She advises clients on data protection, privacy, technology law and cybersecurity.

Mohamed Thahir Sulaiman is a fourth year BALLB (Hons.) student at the National Law School of India University, Bengaluru. He is interested in corporate law and technology law.