India Digital Personal Data Protection Act passage and civil society response (August 2023)

The Digital Personal Data Protection Act, 2023 (DPDPA) completed its parliamentary passage in the first week of August 2023 — introduced in the Lok Sabha on 3 August, passed by the Lok Sabha on 7 August after 52 minutes of debate with 9 members speaking, and passed by the Rajya Sabha on 9 August after 67 minutes with 7 members speaking — before receiving Presidential assent on 11 August. The brevity of parliamentary debate on legislation affecting the data rights of over a billion people, concluding four years of consultative process across four successive drafts, was itself a focal point of civil society condemnation. The passage triggered immediate responses from Access Now, the Internet Freedom Foundation (IFF), and the Editors Guild of India, each characterising the enacted text as falling short of the constitutional standard the Supreme Court's 2017 Puttaswamy judgment had established.

The speed-of-passage critique

Access Now's Asia Pacific Policy Director Raman Jit Singh Chima characterised the government's approach as "a disservice to the people of India" — the bill pushed through Parliament in under a week despite civil society objections that had been documented across four years of consultations on successive drafts. Access Now Asia Pacific Policy Counsel Namrata Maheshwari described the outcome as "a bad law," with damage extending beyond India's borders to its reputation as a data-governance jurisdiction. Civil society groups including IFF had requested referral to a parliamentary select committee for further deliberation; IFF's official statement characterised the Act as "extremely disappointing" across all three fronts on which the IFF India data-protection campaign had pressed since 2019.

The three-front critique

Government surveillance exemptions. The DPDPA's most contested architecture was Section 17, which allowed the Union Government to exempt any "instrumentality" of the State from the Act's requirements on broadly stated grounds — national security, sovereignty, public order, and friendly relations with foreign states — without a proportionality test, judicial review pathway, or time-limited scope. IFF had contested structurally identical exemptions in every prior draft since 2019. IFF warned the law provided no "meaningful safeguards against over-broad surveillance"; Chima characterised the outcome as a law that "enables government-led invasions of privacy and the expanding of surveillance." Access Now's four-component test for world-class data protection — an independent regulator; actionable rights and remedies; clarity on cross-border data flows; and meaningful accountability from all data collectors including the government — was assessed as unmet on all four counts.

RTI Act amendment. Section 44(3) of the DPDPA amended the Right to Information Act, 2005 by inserting "personal information" as a new exempt category. IFF's analysis argued the amendment allowed public authorities to withhold information about public officials acting in official capacity under the guise of privacy protection — weakening the RTI regime's accountability function at the same moment a data protection law was nominally extending privacy rights. Chima described the effect as one that "obscures the right to information which is crucial for accountability from public officials."

Regulator independence. The DPDPA constituted the Data Protection Board as an executive-controlled body, with the Central Government retaining appointment and conditions-of-service authority over its members. IFF had argued since its 2019 JPC submissions that the Puttaswamy ruling's legality-necessity-proportionality framework constitutionally required a regulator independent of the executive. The enacted Act was assessed as failing this requirement; Access Now's framing — "An effective, world-class data protection law requires core tenets: an independent regulator... The bill is devoid of each of these" — captured the coalition-wide assessment.

The press freedom dimension

The Editors Guild of India characterised the law as one that "creates an enabling framework for surveillance of citizens, including of journalists," citing the RTI amendment and the absence of a journalism exemption as provisions that would impair public-interest reporting and expose journalists' sources to disclosure demands under the government's new powers to access personal data from data fiduciaries without consent.

Position in the India and corpus arcs

This is the corpus's first event-level entry in the IFF India data-protection campaign and the first India event in the legislative-advocacy register — distinct from the existing IFF event entries for the Project Panoptic launch and the Delhi Police FRT petition, which targeted specific surveillance tools rather than India's data governance architecture. The enactment-stage civil society response is the closest structural analogue in the corpus to the EDRi-coordinated EU AI Act coalition's trilogue-stage statement — both represent organised civil society responses to legislation being enacted after multi-year campaigning, both note that the enacted text fell short on core demands. The procedural difference is visible in the outcome shape: the DPDPA arrived substantially unchanged from the 2022 draft after 52+67 minutes of parliamentary debate; the EU AI Act incorporated partial civil society wins on biometric surveillance after 18 months of trilogue with structured civil society access.