Unique exemption pathways under the Act alongside large-scale citizen data processing responsibilities — but only for core government functions, not every PSU by default.
Certain government functions may qualify for specific exemptions, but scope must be assessed precisely, not assumed broadly.
A specific exemption covers services like issuing birth/death/community/income certificates and PDS (ration) benefits — but only for the purpose of providing or improving that particular service.
That exemption does not automatically extend to citizen-initiated feedback and complaints, or to sharing that data with any third party other than the government body delivering the service.
PSUs operating in an already-covered commercial sector (a PSU bank, telecom operator, insurer) fall under that industry's obligations instead — public ownership doesn't change the underlying DPDPA requirements.
Surveillance for protection and crime-prevention purposes has more latitude than ordinary commercial processing, but there is still a line data collection and use cannot cross.
Interoperability with other government databases raises purpose-limitation and consent questions.
Legacy systems built long before any privacy-by-design discipline existed.
On the RTI Act's interplay with the DPDPA: Section 44(3) of the DPDP Act amended Section 8(1)(j) of the RTI Act, removing the earlier public-interest balancing test for withholding personal information. This is currently under constitutional challenge before a five-judge Supreme Court Constitution Bench and remains unresolved — we're reserving a firm position here until that's decided.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation