The Wire India: Delhi: Sunday, 16 November 2025.
The IFF said Rule 23 of the DPDP Rules, 2025 “grants unchecked power” to the government to demand personal data from Data Fiduciaries without consent, citing “vague justifications like national security.”
While the union Ministry
of Electronics and Information Technology has on Friday (November 14) notified
the rules of the controversial Digital Personal Data Protection (DPDP) Act,
2025, with immediate effect, critics have said it creates new barriers to transparency
and individual freedoms.
“The DPDP Act, 2023 and its implementing DPDP Rules, 2025, instead of protecting citizens’ data rights, have created new barriers to transparency and individual freedoms. The DPDP Act itself instituted onerous duties on individuals and carved out broad exceptions that weaken the fundamental right to privacy,” said the Internet Freedom Foundation (IFF) in a statement.
While the ministry has said that the DPDP Act’s administrative rules will kick into action and, over the next 18 months, there will be step-wise notification of its other rules, the IFF said that it had urged the government to "avoid long deferrals and to specify clear, phased but shorter implementation timelines so that individuals do not remain without meaningful remedies while infrastructures for protection of personal data are built."
The government has also operationalised with immediate effect Section 44(3) of the DPDP Act, which has a direct bearing on Section 8(1)(j) of the Right to Information (RTI) Act. Provisions related to penalties are also being brought into immediate effect.
“IFF is especially dismayed that the DPDP Rules, 2025 provides statutory backing for enabling personal data collection by state agencies with scant oversight, thereby entrenching state control over personal data,” the IFF said.
The IFF said that Rule 23 of the DPDP Rules, 2025 “grants unchecked power” to the government to demand personal data from Data Fiduciaries without consent, citing “vague justifications like national security.”
“With no clear safeguards, oversight, or challenge mechanism, this provision risks enabling surveillance, over-collection of data, and privacy violations. In practice, this means that the government can compel any data holding entity (such as an internet platform or telecom provider) to furnish user data en masse, merely by invoking broad reasons like “sovereignty,” “integrity of India,” or any function of law,” it said.
It further added that the categories of data access are so broadly defined that they invite abuse and prohibit disclosure of government demands in relation to national security.
“To compound the problem, the DPDP Rules, 2025 impose obligations where data fiduciaries are prohibited from disclosing government demands to Data Principals related to national security, eliminating an important check of transparency. Such gag rules prevent the public from ever knowing the extent of state surveillance,” it said.
While opposition lawmakers and privacy activists and journalists have sought the repeal of Section 44(3) of the Act that amends Section 8(1)(j) of the RTI Act based on which even personal information could have been disclosed, the government has defended the legislation.
The IFF has also reiterated its call for a Data Protection (Amendment) Bill to "restore a strong RTI framework and introduce a journalistic purpose exemption so that privacy is not used as a blanket excuse to deny information," reconstitute the Data Protection Board of India both on its independence and powers to make it an independent regulatory body and narrow state exemptions and surveillance powers.
"Blanket, secret data demands have no place in a rights respecting democracy. The government should also initiate surveillance law reform, to bring intelligence gathering under checks and balances as urged by civil society," it said.
This article went live on November fifteenth, two thousand twenty five, at thirty-three minutes past three in the afternoon.
The IFF said Rule 23 of the DPDP Rules, 2025 “grants unchecked power” to the government to demand personal data from Data Fiduciaries without consent, citing “vague justifications like national security.”
“The DPDP Act, 2023 and its implementing DPDP Rules, 2025, instead of protecting citizens’ data rights, have created new barriers to transparency and individual freedoms. The DPDP Act itself instituted onerous duties on individuals and carved out broad exceptions that weaken the fundamental right to privacy,” said the Internet Freedom Foundation (IFF) in a statement.
While the ministry has said that the DPDP Act’s administrative rules will kick into action and, over the next 18 months, there will be step-wise notification of its other rules, the IFF said that it had urged the government to "avoid long deferrals and to specify clear, phased but shorter implementation timelines so that individuals do not remain without meaningful remedies while infrastructures for protection of personal data are built."
The government has also operationalised with immediate effect Section 44(3) of the DPDP Act, which has a direct bearing on Section 8(1)(j) of the Right to Information (RTI) Act. Provisions related to penalties are also being brought into immediate effect.
“IFF is especially dismayed that the DPDP Rules, 2025 provides statutory backing for enabling personal data collection by state agencies with scant oversight, thereby entrenching state control over personal data,” the IFF said.
The IFF said that Rule 23 of the DPDP Rules, 2025 “grants unchecked power” to the government to demand personal data from Data Fiduciaries without consent, citing “vague justifications like national security.”
“With no clear safeguards, oversight, or challenge mechanism, this provision risks enabling surveillance, over-collection of data, and privacy violations. In practice, this means that the government can compel any data holding entity (such as an internet platform or telecom provider) to furnish user data en masse, merely by invoking broad reasons like “sovereignty,” “integrity of India,” or any function of law,” it said.
It further added that the categories of data access are so broadly defined that they invite abuse and prohibit disclosure of government demands in relation to national security.
“To compound the problem, the DPDP Rules, 2025 impose obligations where data fiduciaries are prohibited from disclosing government demands to Data Principals related to national security, eliminating an important check of transparency. Such gag rules prevent the public from ever knowing the extent of state surveillance,” it said.
While opposition lawmakers and privacy activists and journalists have sought the repeal of Section 44(3) of the Act that amends Section 8(1)(j) of the RTI Act based on which even personal information could have been disclosed, the government has defended the legislation.
The IFF has also reiterated its call for a Data Protection (Amendment) Bill to "restore a strong RTI framework and introduce a journalistic purpose exemption so that privacy is not used as a blanket excuse to deny information," reconstitute the Data Protection Board of India both on its independence and powers to make it an independent regulatory body and narrow state exemptions and surveillance powers.
"Blanket, secret data demands have no place in a rights respecting democracy. The government should also initiate surveillance law reform, to bring intelligence gathering under checks and balances as urged by civil society," it said.
This article went live on November fifteenth, two thousand twenty five, at thirty-three minutes past three in the afternoon.
.JPG)
.JPG)
