TECH POLICY LAW

I. The Government Is Regulating Itself Later Than Everyone Else

The most striking feature of Somanathan's 20 August letter is its timing relative to the pressure being applied on private industry. Startups were told in mid August that no DPDP extension was available. The Cabinet Secretary's own directive to central and state government, the entities holding the largest and most sensitive personal data repositories in the country, welfare, taxation, healthcare, identity, arrived only days later, and asks departments merely to prepare implementation plans and status reports, not to demonstrate completed compliance. The sequencing suggests the private sector is being held to a materially faster and more concrete standard than government departments are being held to themselves.

II. A Demi-Official Letter Is Not a Binding Instrument

Practitioners should be precise about the legal weight of this directive. A letter from the Cabinet Secretary to other secretaries is an internal administrative instruction, not a notification, rule, or order with independent legal force. It carries significant practical weight because it comes from the apex of the civil service hierarchy, but it creates no new statutory obligation beyond what the DPDP Act and Rules already impose on government bodies as data fiduciaries. Any client relying on this letter as evidence of a specific, enforceable government compliance obligation is overreading its status. The DPDP Act's existing textual obligations remain the only enforceable baseline.

III. Government Data Fiduciaries Face a Distinct Legal Posture

Unlike private sector data fiduciaries, government departments processing personal data frequently do so under statutory mandate rather than consent, engaging the Act's provisions on processing for functions of the state and provision of benefits. This creates a structurally different compliance obligation than the consent-driven private sector model. Somanathan's letter's emphasis on consent and grievance mechanism review, phrased identically to private sector guidance, elides this distinction. Departments processing welfare or identity data under statutory authority will need a materially different DPDP compliance approach than a commercial data fiduciary, and generic guidance modelled on private sector expectations risks producing box-ticking exercises that do not address the actual legal basis under which government processing occurs.

IV. Vendor Contract Audits Will Be the Practical Bottleneck

Of the specific actions Somanathan directs, vendor contract audits are likely to prove the most operationally demanding. Government departments across welfare, taxation, healthcare, and identity systems rely on an extensive and often poorly documented web of technology vendors and data processors accumulated over years of separate procurement cycles. Bringing these contracts into compliance with DPDP's processor obligations, including data processing agreements with defined purposes, security safeguards, and breach notification chains, is a multi year undertaking in most large private organisations with dedicated procurement and legal functions. Government departments attempting the same exercise without comparable resourcing should be expected to produce partial, inconsistent results within the compressed timeline this letter implies. Departments with the largest and most consequential vendor ecosystems, those running welfare disbursal, healthcare, and identity platforms, are precisely the departments least likely to have dedicated privacy or procurement staff capable of executing a rigorous audit, meaning the highest-risk data holdings may receive the shallowest review under this directive's current staffing assumptions.

V. Comparative Note

The GDPR's accountability principle imposes broadly equivalent obligations on public authorities as on private entities, and European public sector bodies have in practice lagged private sector compliance by a significant margin, with several national data protection authorities publicly criticising government agencies for slower implementation than industry. India's own directive, arriving after rather than before comparable private sector pressure, risks repeating this pattern rather than avoiding it, notwithstanding the letter's stated urgency.

VI. Practitioner Guidance

Firms that contract with government departments as vendors or data processors should anticipate incoming requests for DPDP-compliant data processing agreements as departments work through the vendor audit direction, and should proactively prepare standard DPDP addenda to existing government contracts rather than waiting for departments to initiate the process, given the resourcing gaps likely to slow government-side initiation. Vendors that move first, offering a compliant data processing agreement template before a department requests one, are likely to gain a meaningful procurement advantage during renewal cycles that fall within the next eighteen months, as departments will favour counterparties who reduce rather than add to their own compliance workload.