The Digital Shield and the Sovereign State: A Constitutional and Legal Analysis of Cybersecurity, Data Privacy, and the DPDPA 2023 in India

Abstract

India's economy is developing rapidly due to digitization, changing the way citizens interact with the government and improving the way services are delivered. However, significant cybersecurity issues are identified in India's digital system, demanding new ways to protect citizens' "informational privacy”. This study explores the evolution of Indian (privacy) law by significant courts' decisions; starting with M.P. Sharma (1954) and ending with the K.S. Puttaswamy v Union of India (2017) that established the right to privacy as part of the fundamental rights framework established through Article 14, 19, and 21 of the Constitution. Accordingly, a close analysis of the Digital Personal Data Protection Act 2023 (“The DPDPA”) is reported exploring the conflict between state interests and individual liberties and specifically the broad exemptions provided to government agencies pursuant to Section 17 of the DPDPA. It is these same exemptions that some persons believe will enable unchecked government surveillance on an equivalent basis as the “Going Dark” debate related to encrypted data. The paper will focus on the technical aspects of how the laws and regulations defining end-to-end encrypted systems, zero-trust security models (pursuant to CERT-In’s requirements to report breaches within six hours), and the requirements to report breaches/other incidents within six hours can be interpreted and enforced. Comparisons will be made to the General Data Protection Regulation (GDPR) of the European Union and how there are gaps in the Indian framework that do not ensure regulatory independence and/or facilitate cross-border data transfers. Ultimately, while DPDPA 2023 may represent an important moment in Indian legal history, its success or failure will depend more on the operational independence of the Data Protection Board than on the harmonization of legal requirements with the changing nature of cybersecurity.