—Siddharth Chaturvedi, Academic Fellow, National Law University, Delhi, India
Introduction
On 14th November 2025, the Indian Ministry of Electronics and Information Technology (MeitY) notified the Digital Data Protection Rules, 2025. This moment was historic for the country since it brought the Digital Personal Data Protection Act (DPDP Act, 2023) to life by operationalizing it. However, the whole Act and the Rules are yet to be enforced, since the Government has envisaged a staggered timeline over two years to fully enforce the law. One of the interesting provisions of the DPDP Act, 2023 is Section 10, which entails the imposition of additional obligations on Significant Data Fiduciaries. This post aims to analyze the obligations imposed on Big Tech and whether these fall within the proportionality doctrine propounded by the Supreme Court in KS Puttaswamy. It also recommends certain changes which can be made to instil greater clarity in the law.
What obligations does Section 10 of the DPDP Act, 2023 impose on Big Tech?
Section 10 of the DPDP Act, 2023 grants a discretionary power to the Central Government of India to notify any Data Fiduciary or class of Data Fiduciaries that they qualify as a Significant Data Fiduciary on the basis of factors such as the volume and sensitivity of personal data processed, and the potential impact on the sovereignty and integrity of India. One of the interesting subclauses is (d), which states that any Data Fiduciary can be designated as a Significant Data Fiduciary if it poses a risk to electoral democracy. Possibly, this clause has been framed keeping in mind the Cambridge Analytica fiasco, where there was evidence that a political consultancy firm used personal information collected from more than 50 million Facebook users to influence elections in India, and one of the prominent opposition parties in India was its client. A study by Oxford also revealed that organized social media manipulation campaigns were found in 81 surveyed countries, and that big tech companies were being used as cyber troops to increase the chances of winning elections. Against this background, certain layers of additional compliance are imposed on Significant Data Fiduciaries. A designated Significant Data Fiduciary will have to appoint a Data Protection Officer, an independent Data Auditor and undertake other measures such as periodic data protection impact assessments, reflecting the need for additional compliance in relation to big tech giants such as Google, Meta and X (Twitter).
Problems in Section 10 and the law of proportionality
It is heartening to see that the intention behind the framing of Section 10 is sound, i.e. to ensure that the rights of the data subjects are protected, such as through control over personal data, anonymity and management of risk to the Data Principals. However, the framing of some clauses appears to be problematic. In particular, there is a high degree of subjectivity in deciding what constitutes a risk to electoral democracy. As far as judicial precedent is concerned, there is no definition of what would qualify as such. This can in the future provide leeway to governments to designate a company on the basis of non-objective factors. Further, another phrase which is ambiguous concerns the volume and sensitivity of personal data processed, since there is no threshold defined to designate how much processing of personal data will lead to the additional designation of Significant Data Fiduciary. To determine whether Section 10 will withstand the constitutional scrutiny, it is pertinent to refer to the proportionality doctrine. This legal doctrine helps to determine whether any action or government taken by the Government is excessive and whether it is able to achieve its purported goal.
In 2017, the Supreme Court of India, in the landmark judgment ofKS Puttaswamy, recognised the Right to Privacy as a constitutional right. It also laid down four factors to determine proportionality, which are as follows-
- The action must be sanctioned by law
- The proposed action must fulfil a legitimate state aim
- The extent of the interference must be proportionate to the need for such existence
- There must be procedural guarantees
By applying this four-limb test, it becomes clear that although Section 10 fulfils the first two steps, it is likely to run afoul of the third and the fourth step. It will be difficult to prove how a particular platform constitutes a risk to democracy. The third limb also takes into consideration whether an alternative measure was available which constitutes a less restrictive measure. However, Section 10 is unlikely to pass this test since the State has alternative measures to protect democracy such as algorithmic transparency, targeting of Coordinated Inauthentic Behaviour (CIB) and bot networks. Regarding the fourth step, procedural fairness demands that a law must be clear for a citizen or corporation to foresee the legal consequences. Although Article 19 (2) of the Constitution mentions reasonable restrictions with regard to the sovereignty and integrity of India, the addition of the words ‘potential impact’ on sovereignty and integrity (clause c) has added confusion and uncertainty. This is because ‘reasonable restrictions’ contain specific grounds and have been read narrowly in the landmark case of Superintendent,Central Prison v. Ram Manohar Lohia.
However, the question whether there is a risk to democracy remains open-ended, and appears to be a political metric rather than a part of the legal test. Lastly, companies being designated will not have the opportunity to challenge their designation as Significant Data Fiduciary, which violates the basic tenets of fair procedure and audi alteram partem, which requires that the other party must be given an opportunity to present their case. Thus, Section 10 in its present form is unlikely to pass the proportionality test.
Suggestions and Conclusion
One of the first changes that must be effected with regard to the DPDP Act 2023 is the removal of clause (d), concerning the risk to democracy. It is important to note that the Representation of the People Act, 1951 (ROPA), already penalizes the conduct of any person who is engaged in promoting enmity between classes in connection with an election (Section 125), along with propagating any election-related matter (Section 126). Thus, there are adequate safeguards present in ROPA. The Data Protection Board of India can also draw inspiration from the Draft Digital Competition Committee Report, which recommends designation of an enterprise as a Systemically Significant Digital Enterprise (a concept similar to that of a Significant Data Fiduciary), on the basis of having at least one crore users or at least ten thousand users. The Data Protection Board of India can also conduct an independent audit, and if the empirical evidence shows that the platform’s hate speech or available content has surpassed a decided threshold (for example, X % percent of total available content on the platform), it can be designated as a Significant Data Fiduciary.
The DPDP Act 2023, as a package, offers a promising start for building and supporting digital infrastructure in the country, along with safeguarding the privacy of the users. The government’s efforts to ensure the protection of democracy are laudable, but it is hoped that the Government will take into consideration certain changes to ensure that the law is not vague and that the chances of prolonged litigation are also reduced, well before the deadline for full enforcement of the DPDP Act, 2023, on May 13, 2027.
Suggested citation: Siddharth Chaturvedi, Reining in Big Tech: Streamlining their Obligations under India’s DPDP Act, 2023, Int’l J. Const. L. Blog, Oct. 2, 2026, at: http://www.iconnectblog.com/reining-in-big-tech-streamlining-their-obligations-under-indias-dpdp-act-2023/