Quick Answer
Government bodies and Public Sector Undertakings (PSUs) are subject to the DPDP Act 2023 but may qualify for certain exemptions under Section 17 for state functions and national security purposes. PSUs processing citizen data for government schemes, subsidies, and welfare programmes must still provide privacy notices and implement adequate security safeguards. The Act's exemptions for state functions do not extend to commercial activities of PSUs.
Quick AnswerGovernment entities must identify their lawful basis for each data processing activity (consent, legal obligation, or legitimate state function), implement data minimisation in citizen-facing portals, and build grievance mechanisms for data rights.
DPDP Compliance Checklist
- Identify lawful basis for each processing activity — consent, legal obligation, or state function
- Map all citizen-facing data collection: digital portals, physical forms, call centres
- Implement data minimisation — collect only what is needed for the specific government service
- Publish plain-language privacy notices on all digital portals in multiple languages
- Implement grievance mechanism for citizen data rights — name a Grievance Officer
- Review inter-ministry and inter-department data sharing arrangements
- Implement secure storage for Aadhaar-linked data — follow UIDAI security guidelines
- Train government staff on data handling obligations and citizen data rights
- Implement 72-hour breach notification SOP with CERT-In
- Conduct annual DPDP compliance assessment for all digital services
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Do government entities need citizen consent under DPDP?+
Not always. Government processing for legitimate state functions (law enforcement, welfare delivery) may not require consent. However, discretionary data collection does require consent.
Are PSUs treated differently from private companies?+
PSUs have the same compliance obligations as private companies for personal data processing. Being government-owned does not exempt them from DPDP Act.
Can government data be shared across departments freely?+
No. Inter-departmental sharing must have a lawful basis. Ad-hoc sharing of citizen data without legal authority may violate DPDP.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
