India’s Digital Personal Data Protection (DPDP) Act, 2023, seeks to balance individual privacy with the realities of a rapidly expanding digital economy. Section 36 of the Act empowers the State to require the Data Protection Board (DPB), a data fiduciary or a data intermediary to furnish information. This, however, is not an instrument of unchecked State power. Rather, it is the enforcement mechanism that makes privacy rights meaningful in practice — providing a suraksha kawach (security armour) for citizens.

Every day, citizens entrust banks, fintech platforms, social media companies, e-commerce platforms and ed-tech firms with sensitive financial, biometric, and personal information. When these entities fail to protect that data, the State must be equipped to respond swiftly. Section 36 provides that capability while remaining firmly tied to the Act’s objective of safeguarding privacy and ensuring lawful processing of personal data.

Its significance becomes evident in real-world situations. Consider a major fintech platform suffering a data breach that exposes Aadhaar-linked bank details of millions of users. Fraudsters could immediately exploit the leaked information to obtain unauthorised loans in victims’ names. Section 36 enables the Data Protection Board to demand access logs, breach........

© hindustantimes