The Role of Public Law in Data Protection, AI Governance and E-Governance Accountability

Why public law matters in the digital age

Online banking, e-commerce, biometric identity and AI-assisted decisions now run through a small number of digital systems, many of them operated by or for the State. That brings efficiency and access, but also three kinds of risk: misuse of personal data, unfair or opaque algorithms, and State power exercised through systems that citizens cannot easily see or challenge.

Public law is the body of constitutional, administrative and statutory rules that governs the relationship between the individual and the State, and that limits how public power, and increasingly private power exercised through technology, may be used. This article looks at how it operates in three areas: data protection, AI governance and e-governance. For each it sets out where the law stands in India as of 31 October 2026, including developments since 2025 that earlier commentary often misses, such as the notification of the DPDP Rules and the new rules on AI-generated content.

Data protection: the constitutional foundation

Personal data is often called “the new oil”, a phrase usually traced to a 2006 speech by the data scientist Clive Humby.^[1] The comparison captures its commercial value, but it understates the legal point: unlike oil, personal data belongs to a person, and its misuse can harm that person’s dignity, autonomy and safety.

The European Union. The General Data Protection Regulation (GDPR) gives individuals enforceable rights over their data. Consent is only one of six lawful grounds for processing, and valid consent has its own conditions.^[2] The right to erasure in Article 17 is not unlimited: it applies on listed grounds, such as the data no longer being needed or consent being withdrawn, and gives way to exceptions such as freedom of expression, legal obligations, public health and legal claims.^[3] The GDPR also reaches controllers outside the EU that offer goods or services to people in the Union, or monitor their behaviour there.^[4]

India: the right to privacy. In Justice K.S. Puttaswamy v. Union of India (2017), a nine-Judge Bench of the Supreme Court held unanimously on 24 August 2017 that privacy is a fundamental right, protected as an intrinsic part of the right to life and personal liberty under Article 21 and as part of the freedoms guaranteed by Part III of the Constitution. The Court overruled the earlier decisions in M.P. Sharma and Kharak Singh to the extent they said otherwise.^[5] Its plurality opinion also set the test that State intrusion on privacy must meet: a law (legality), a legitimate aim (need) and a proportionate means of achieving it.^[5]

The test was applied the next year in the Aadhaar case. On 26 September 2018 the Constitution Bench, by a majority of four to one, upheld the Aadhaar Act, including Section 7 (use of Aadhaar for State subsidies and benefits), but struck down Section 33(2) (disclosure in the interest of national security), read down Section 57 so that private entities could not demand Aadhaar authentication, and held that compulsory linking of Aadhaar to bank accounts and mobile numbers failed the proportionality test.^[6] Proportionality has since been the yardstick for most public-law challenges to State data practices.

The Digital Personal Data Protection Act, 2023

Parliament’s answer to Puttaswamy is the Digital Personal Data Protection Act, 2023 (Act 22 of 2023). It was passed by the Lok Sabha on 7 August and the Rajya Sabha on 9 August 2023, and is dated 11 August 2023, when it received the President’s assent.^{[7, 8]} Its main features are these:

Lawful processing. Personal data may be processed only for a lawful purpose, either with the individual’s consent or for “certain legitimate uses” (Section 4). A request for consent must be preceded or accompanied by a notice (Section 5). Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the specified purpose (Section 6). The legitimate uses in Section 7 include data voluntarily provided for a specified purpose and the State’s provision of a subsidy, benefit, service, certificate, licence or permit.^[8]

Duties of the Data Fiduciary. A Data Fiduciary (the entity that decides why and how data is processed) must ensure the completeness, accuracy and consistency of data used to make a decision about a person or disclosed to another fiduciary (Section 8(3)); protect data with reasonable security safeguards (Section 8(5)); report a personal data breach to the Data Protection Board and to each affected person (Section 8(6)); and erase data when consent is withdrawn or the purpose is no longer served, unless the law requires retention (Section 8(7)).^[8]

Rights and remedies. Individuals (Data Principals) have rights of access (Section 11), correction, completion, updating and erasure (Section 12) and grievance redressal (Section 13). Penalties are set out in the Schedule and go up to Rs 250 crore for a failure to maintain reasonable security safeguards. The Data Protection Board of India hears complaints and imposes penalties, and appeals lie to the Telecom Disputes Settlement and Appellate Tribunal.^{[8, 7]} The Act also omits Section 43A of the Information Technology Act, 2000, the older provision on compensation for failure to protect data (Section 44(2)).^[8]

Two points of difference with the GDPR are worth noting. The Act has no counterpart to Article 22 of the GDPR, which restricts decisions based solely on automated processing, and the right to erasure in Section 12 is tied to data processed on the basis of consent, subject to retention for the specified purpose or legal compliance.^{[2, 8]}

Where the DPDP framework stands today

Some commentary still says that the Act is “yet to be fully notified” and that rules were only “released” in January 2025. That is out of date. Draft Rules were published for comment in January 2025, and the final Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025.^{[9, 10]}

Commencement is in phases. Rules 1, 2 and 17 to 21, which include the constitution and working of the Data Protection Board, took effect on notification. Rule 4, on the registration of Consent Managers, takes effect one year after notification, that is, on 13 November 2026. Rules 3, 5 to 16, 22 and 23, which contain most of the working obligations (notice, consent, security, breach intimation, State processing standards and others), take effect eighteen months after notification, around 13 May 2027.^[9] As of the date of this article, therefore, most of the Data Fiduciary duties and the individual’s rights are not yet enforceable. The Rules also make the Board a digital office that conducts proceedings without physical presence.^[9]

The public-law questions the Act raises

Because the State is both the regulator and one of the largest holders of personal data, the Act’s treatment of the State is the part that matters most to public law. Four provisions stand out.

Exemption by notification. Section 17(2)(a) takes out of the Act processing by any instrumentality of the State that the Central Government notifies in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, public order or preventing incitement to related offences. The Act does not itself list the bodies concerned.^[8]

Lighter duties for the State. Under Section 17(4), State processing is not subject to the duty to erase data (Section 8(7)) or to the right of erasure (Section 12(3)), and, where no decision affecting the person is made, to the right of correction and updating (Section 12(2)). Section 17(1)(c) also disapplies most obligations where data is processed for the prevention, detection, investigation or prosecution of offences.^[8] PRS Legislative Research has argued that these exemptions could permit processing without adequate checks and may conflict with the right to privacy.^[7]

Power to call for information. Section 36 allows the Central Government to require the Board, and any Data Fiduciary or intermediary, to furnish such information as it may call for.^[8]

The Right to Information Act. Section 44(3) replaces Section 8(1)(j) of the Right to Information Act, 2005 with the words “information which relates to personal information”.^[8] Petitioners say this removes the earlier balancing test and public-interest override. On 16 February 2026 a Bench led by the Chief Justice of India issued notice on writ petitions challenging Section 44(3), Section 36 and other provisions of the Act and the Rules; as reported, the Court declined to stay the Act and referred the questions to a larger Bench.^[11] The Act therefore remains in force while its validity is examined, and the outcome will be a test of how far Puttaswamy’s proportionality standard constrains the legislature’s own exemptions. Later developments should be checked on the Court’s website.

AI governance and the deepfake challenge

Artificial intelligence, and in particular generative AI that produces realistic but fabricated audio, images and video, raises a public-law problem as well as a private one. Deepfakes can spread disinformation, manipulate voters, damage reputations and violate dignity, and they do so at a speed that ordinary legal processes struggle to match.

India’s approach. India does not have a standalone AI statute. The India AI Governance Guidelines, released by the Ministry of Electronics and Information Technology (MeitY) on 5 November 2025, rely on existing laws such as the Information Technology Act and the DPDP Act, on sector regulators and on a graded approach to liability, with targeted amendments where gaps appear.^[12]

The IT Rules amendment of 2026. The sharpest legal change so far is the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified on 10 February 2026 and in force from 20 February 2026. They address “synthetically generated information”, meaning audio, visual or audio-visual content that is artificially or algorithmically created or altered so that it appears real. Permitted synthetic content must be prominently labelled and carry permanent metadata or provenance markers that cannot be removed. Significant social media intermediaries (those with more than 50 lakh registered users) must obtain a user declaration on whether content is synthetic and verify it with technical measures, and intermediaries must act on government or court orders within three hours of receipt, down from 36 hours.^{[13, 14]} Because the definition covers only audio, visual and audio-visual content, text-only content falls outside it, and the rules work through intermediaries. The short takedown deadline may be tested for proportionality and for its effect on free speech under Article 19(1)(a).

The European Union. The EU’s Artificial Intelligence Act, Regulation (EU) 2024/1689, takes a risk-based approach, with stricter duties for high-risk systems and transparency duties, including labelling of deepfakes, in Article 50.^[15] The timetable has since moved. Regulation (EU) 2026/1744, the “AI Omnibus”, published on 24 July 2026 and in force from 27 July 2026, postponed the high-risk obligations for stand-alone (Annex III) systems from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products to 2 August 2028, while the Article 50 transparency duties continue to apply from 2 August 2026.^[16]

What a responsible AI framework should contain. Whatever the model of regulation, four elements recur:

Design and development: fairness, transparency and explainability built in from the outset, with testing for bias. Deployment and oversight: audit trails, explainable outputs and a route to remedy for a person harmed by a decision. Public engagement: media-literacy and capacity-building so that citizens can recognise and report AI-generated content. Legal accountability: clear liability for those who create and spread harmful synthetic content, applied through existing criminal, civil and intermediary law.

The gap that public law has yet to close in India is in automated decision-making by the State. The DPDP Act requires accuracy only where data is used to make a decision about a person (Section 8(3)); it does not give a right to an explanation or to human review.^[8] Where such a system is used for public benefits or policing, the constitutional tests of legality, reasonableness and proportionality, and not a data protection statute, are the main safeguard.

E-governance and accountability

Digital delivery of State services. E-governance covers Digital India, Aadhaar-enabled services, online grievance platforms and e-courts. The e-Courts project, for example, was approved for a third phase by the Union Cabinet in September 2023 with an outlay of Rs 7,210 crore.^[17] Properly designed, these systems make the State more efficient, transparent and reachable.

Exclusion. They can also shut people out. In Amar Jain v. Union of India (30 April 2025), the Supreme Court dealt with e-KYC procedures that required a live photograph with actions such as blinking, which acid-attack survivors and visually impaired persons could not complete. It held that the right to life and personal liberty under Article 21 includes a right to digital access, and directed that e-KYC and other digital processes be made accessible, relying on the Rights of Persons with Disabilities Act, 2016.^[18] The principle reaches beyond disability: where a service is available only online, the State must ensure that those who cannot use the online route are not left without a remedy.

Surveillance and restriction. Digital State power can also be used to monitor or to restrict. In Anuradha Bhasin v. Union of India (2020), the Supreme Court held that expression through the internet is protected by Article 19(1)(a), that restrictions must satisfy Article 19(2) and the proportionality test, and that indefinite suspension of internet services is not permitted. Shutdown orders must be reasoned and are open to judicial review.^[19] The Aadhaar judgment, discussed above, applied the same logic to compulsory linking of identity with bank accounts and mobile numbers.^[6]

The accountability tools. Public law supplies three: the rule of law, which requires State action to rest on law and not on arbitrary discretion; judicial review under Articles 32 and 226, where courts test digital State action for legality and proportionality; and remedial mechanisms, such as statutory grievance procedures, the Data Protection Board and an appeal to the Appellate Tribunal under the DPDP Act, and citizen charters.^{[8, 9]} Each depends on transparency: a person cannot challenge a decision, an algorithm or a data-sharing arrangement they do not know about, which is why the Right to Information Act and the debate over Section 44(3) are part of the same subject.

Democratic resilience

Digital tools can widen civic participation, and they can also erode democratic processes through microtargeted disinformation, opaque algorithmic decisions and unchecked State surveillance. Public law is the safeguard that keeps technology as a means of empowerment and not of control.

By regulating the use of personal data, supervising AI systems and attaching accountability to e-governance, public law supports democratic legitimacy and public trust, and keeps the State answerable for how it uses its digital power. Across all three areas, one pattern recurs in the Indian cases: the measure is lawful, serves a legitimate purpose, and goes no further than necessary. That is the proportionality standard from Puttaswamy, and it is the standard to which new rules, including the exemptions in the DPDP Act and the takedown timelines in the 2026 IT Rules, will be held.^[5]

What individuals and organisations should do now

Businesses. Treat 13 May 2027 as the working deadline for the main DPDP obligations: map the personal data you hold, review notices and consent flows against Sections 5 and 6, put breach-response and erasure processes in place, and check vendor contracts. Those that may act as Consent Managers should note that registration opens under Rule 4 from 13 November 2026.^[9] For our wider guidance, see our article on the DPDP Act and corporate compliance architecture.

Platforms and publishers. If you host or generate AI content, check whether it falls within “synthetically generated information” and whether labelling, provenance metadata, user declarations and the three-hour takedown timeline apply to you.^[13] Our article on AI and copyright in India covers the separate question of training data.

Individuals. Once the relevant provisions commence, you will be able to ask a Data Fiduciary for access, correction or erasure and to use its grievance process before approaching the Board.^[8] If a State digital process excludes you, or if your data is used without a lawful basis, a writ petition may be available; our writ and constitutional practice advises on such matters. This article is general information, not legal advice.

Frequently asked questions

Is the DPDP Act in force? Partly. The Act received assent on 11 August 2023. The DPDP Rules, 2025 were notified on 13 November 2025, and the provisions on the Data Protection Board took effect then. Consent Manager registration begins one year after notification, and the main obligations of Data Fiduciaries take effect eighteen months after it, around 13 May 2027.^{[8, 9]}

Is privacy a fundamental right in India? Yes. A nine-Judge Bench of the Supreme Court held in Puttaswamy (2017) that privacy is protected under Article 21 and Part III of the Constitution. Any State intrusion must satisfy legality, legitimate aim and proportionality.^[5]

Does India have a law on deepfakes? There is no separate AI statute. Deepfakes are addressed through the Information Technology Act and the IT Rules, as amended in February 2026 to require labelling of synthetic content and faster takedown, and through the criminal and civil law on defamation, impersonation and obscenity.^{[12, 13]}

Does the EU AI Act apply in India? Not directly. It applies to AI systems placed on the EU market or whose output is used in the Union, so an Indian provider with EU customers may be covered. Its high-risk timetable was postponed in July 2026.^{[15, 16]}

Can the State be challenged for exclusion from digital services? Yes. In Amar Jain (2025) the Supreme Court held that digital access forms part of Article 21 and directed accessible e-KYC processes.^[18]

Conclusion

Public law is indispensable in the digital age. Without it, technology can erode rights and weaken the institutions that protect them. India now has the constitutional foundation in Puttaswamy, a data protection statute and Rules that are being brought into force in stages, and rules on AI-generated content, but important questions remain open: the width of the State’s exemptions, the absence of rights against automated decisions, and the balance between speed of takedown and freedom of expression.

India can draw on the GDPR and the EU AI Act, including the EU’s own experience of having to adjust its timetable, while shaping rules to its own social context, in which digital exclusion is as real a risk as digital surveillance. Done with care, the result lets technology serve justice and democracy instead of overriding them.