Data governance

1. Meaning, scope and governance significance

Data governance determines who may collect or access data, for what purpose, under which safeguards and with what accountability. Data management implements these decisions through databases, storage and processing systems. Cybersecurity protects systems and information against threats, while data protection regulates the processing of personal data. These fields overlap, but none substitutes for the others: a technically secure database may still contain unlawfully collected or inaccurate information.

Public administration uses data to identify beneficiaries, assess needs, transfer benefits, allocate budgets and evaluate programmes. Civil registration, land records, health information, school databases and environmental monitoring therefore form an important administrative infrastructure. Their usefulness depends on accuracy, timeliness, completeness, consistent definitions and representativeness. Digitising an incorrect land record or outdated eligibility list can reproduce injustice faster rather than correct it.

Personal data concerns an identifiable individual; non-personal data does not identify an individual in its relevant context. Administrative data arise from routine government operations, whereas official statistics are produced using defined statistical methods. These categories require different access arrangements. Aggregate rainfall data may be openly reusable, while identifiable medical records require strict safeguards. Combining otherwise innocuous datasets can also reveal identity or sensitive characteristics.

• Public value: better service delivery, evidence-based policy, research and accountability.
• Rights dimension: privacy, equality, dignity, due process and access to remedies.
• Institutional dimension: clear ownership of decisions, data stewardship and oversight throughout the data lifecycle.

2. Constitutional, legal and policy architecture

In Puttaswamy (2017), the Supreme Court recognised privacy as a fundamental right. State interference must satisfy constitutional requirements including legality, a legitimate State aim, proportionality and safeguards against abuse. Consequently, administrative convenience alone cannot justify unlimited collection or indefinite retention. Data-driven decisions must also respect Article 14: opaque classifications or error-prone matching can produce arbitrary exclusion even when a programme pursues a legitimate welfare objective.

The Digital Personal Data Protection Act, 2023 establishes a framework for digital personal data, including information collected digitally and information collected offline and subsequently digitised. It also covers specified processing outside India connected with offering goods or services to individuals in India. Processing must rest on consent or certain legitimate uses recognised by the Act. Its provisions address security safeguards, breach intimation, correction and erasure, grievance redressal and nomination, alongside duties of Data Principals and additional obligations for Significant Data Fiduciaries.

The Act provides for a Data Protection Board of India and monetary penalties. Its consent standard is free, specific, informed, unconditional and unambiguous, expressed through clear affirmative action. Nevertheless, rights, exceptions and institutional powers must be studied together. The Act does not create a general right to data portability, and it does not impose blanket localisation of all personal data. Operational compliance requires checking the applicable rules and commencement notifications rather than assuming every provision became enforceable upon assent.

Other important instruments include the Information Technology Act, 2000, the Aadhaar Act, 2016, the Right to Information Act, 2005 and sector-specific regulations. The National Data Sharing and Accessibility Policy, 2012 and the Open Government Data Platform support access to shareable government datasets. The Draft National Data Governance Framework Policy, 2022 proposed better management and access concerning government non-personal and anonymised data; a draft policy should not be confused with binding legislation.

• Privacy and transparency should be reconciled through lawful disclosure, aggregation and proportionate redaction.
• Open data policy does not authorise publication of identifiable beneficiary or medical records.
• Sectoral requirements and constitutional safeguards remain relevant alongside general data protection law.

3. Governing the data lifecycle

Governance begins before collection. A department should specify the public purpose, legal authority, necessary fields and retention period. Data minimisation means collecting only what is required; purpose limitation prevents routine reuse for unrelated objectives without a valid basis. Notices must be understandable and accessible. Where consent is relied upon, dependence on an essential service should not be exploited to obtain agreement to unnecessary processing.

During processing, designated data stewards should maintain metadata, standard definitions, validation checks and correction mechanisms. Interoperability requires semantic consistency as well as technical connectivity: two departments exchanging records must mean the same thing by household, disability or residence. Application programming interfaces can support controlled exchange, but unrestricted database integration increases profiling and security risks. Pseudonymisation reduces direct exposure but remains reversible through additional information.

Access controls, encryption, audit logs, tested backups and incident-response procedures should accompany sharing agreements that specify purpose, recipients, retention and responsibility for breaches. Publication requires disclosure-risk assessment because aggregation alone may not prevent identification in small groups. At the end of the lifecycle, records should be erased or securely archived according to lawful retention requirements. Correction, deletion and access restrictions must also extend to contractors and downstream recipients.

• Maintain a data inventory identifying datasets, custodians, legal bases and authorised users.
• Apply privacy by design and stronger review to high-risk processing.
• Evaluate quality through accuracy, completeness, timeliness, consistency and relevance.

4. Major challenges in Indian administration

Fragmented databases, uneven State capacity, legacy software and weak documentation obstruct reliable exchange. Centralised standards can improve comparability, but implementation must respect federal responsibilities and local administrative contexts. Digital exclusion further distorts datasets: people lacking connectivity, documentation or updated records may become statistically invisible. Authentication failures, spelling differences and outdated household information can then become grounds for wrongful denial.

Large linked datasets create risks of surveillance, function creep and re-identification. Procurement may give private vendors excessive control over public information, producing lock-in and unclear liability. Consent fatigue and complex notices weaken meaningful choice. Algorithms trained on incomplete administrative records can reproduce historical disadvantage; their outputs should not be treated as neutral merely because they are computational.

Open data also faces a quality problem. Scanned documents, missing metadata, irregular updates and changing definitions limit reuse. Publishing large volumes of data is not equivalent to transparency if citizens cannot understand decisions or obtain remedies. Governments therefore need explainability, accessible grievance mechanisms and independent scrutiny, not merely more dashboards.

• Key tension: integration can improve services while increasing the consequences of a breach.
• Key equity concern: absence from a database must not automatically imply absence of entitlement.

5. Reform priorities and the way forward

India needs accountable institutions alongside digital infrastructure. Departments should assign stewardship responsibilities, undertake proportionate privacy and security assessments, and include audit rights, portability and secure exit arrangements in vendor contracts. Common standards should be developed collaboratively with States. Public dashboards should report data quality and grievance outcomes without exposing individuals.

A rights-respecting approach combines secure interoperability with assisted access, alternative verification and human review of adverse decisions. Civil servants need training in statistics, privacy, cybersecurity and procurement. Success should be judged by fewer wrongful exclusions, timely correction, trustworthy sharing and demonstrable public benefit—not by the volume of data collected.

• Collect less, verify quality, restrict access and retain only as lawfully necessary.
• Build accessible remedies into services rather than adding them after failures.
• Treat public trust as an outcome of accountable institutions, not a substitute for safeguards.

Previous year questions

No UPSC question has been asked directly on this micro-topic yet. Use the practice questions below.

Practice questions