Parliament takes up a sweeping data governance bill

For nearly a decade, India's approach to citizen data has been governed by a scattered set of departmental circulars, sectoral rules and court-mandated safeguards rather than a single statute. The bill introduced this session is an attempt to close that gap, replacing overlapping frameworks with one accountability standard that applies uniformly to central ministries, state departments and the public bodies that sit beneath them.

At its core, the draft requires every public authority that holds citizen data to publish a register disclosing what it collects, the legal basis for collecting it, and how long it intends to keep it. Officials involved in drafting the bill say the register requirement is meant to end the practice of departments holding records indefinitely simply because no rule forced them to specify a retention period.

The breach-notification provisions have drawn the most scrutiny from technologists and privacy lawyers. The draft sets a 90-day outer limit for public authorities to disclose a data breach to an oversight body, a window that supporters call workable and critics call generous relative to global norms, where 72-hour disclosure windows are increasingly standard.

Supporters argue that a single statute reduces the compliance confusion that has dogged both citizens seeking redress and administrators trying to interpret conflicting departmental rules. "A single standard is only meaningful if the exemptions are narrow and reviewable," said a senior fellow at a Delhi-based public policy research centre who has studied earlier drafts of the framework. "Otherwise you've just centralised the ambiguity instead of removing it."

The sharpest disagreement concerns the carve-outs available to security and intelligence-linked agencies, which under the current text can seek broad exemptions from disclosure and retention limits on national-security grounds. Opposition members and several civil society coalitions argue the exemption clause, as worded, could swallow the rule itself; the government maintains such carve-outs mirror standard practice in comparable democracies.

A parallel concern, raised largely by state government representatives, is administrative capacity. Several states have told the joint committee examining the bill that meeting the register and retention requirements within the proposed implementation timeline would require hiring and training data officers at a scale few state IT departments currently have budgeted for.