In June, the Union government restricted access to Telegram across the country under the IT Act, citing paper-leak concerns. The company has since challenged the order in court, claiming it excessive. A few days later, on July 1, the IT ministry asked WhatsApp to suspend its new usernames feature while they consult on fraud and impersonation risks. While neither of these actions falls under Section 36, Digital Personal Data Protection (DPDP) Act, together, they highlight a trend of executive notices issued quickly with limited public explanations. This forms a useful reference for Section 36, which relies on similar discretion but focuses on personal data and is currently being reviewed by the Supreme Court.

When the DPDP Act comes into full effect in May 2027, over a billion citizens will have rights to know who holds their data, to correct it, and to delete it. That said, powers reserved for the government are significant but often overlooked.

Also read: Films like Satluj strengthen India’s democratic core

Section 36 permits the Centre to request information from any data fiduciary or intermediary related to the Act. Rule 23 of the DPDP Rules, 2025, and its Seventh Schedule define these requests as pertaining to national security, statutory obligations, and assessing “Significant........

© hindustantimes