Data privacy and cyber-security framework in India – OPSC OAS Mains GS Paper II PYQ

📝Model Answer

Introduction

Data Privacy refers to an individual’s right to control the collection, storage, and use of their personal information, while Cyber Security refers to the protection of computer systems, networks, and data from unauthorized access, attack, or damage. With rapid digitisation, both have become critical concerns for governance, national security, and citizens’ fundamental rights.

(a) Role of Government in Regulating Data Privacy and Cyber-Security

1. Legislative Framework: Enacting laws such as the IT Act 2000 and the Digital Personal Data Protection (DPDP) Act 2023 to provide legal backing for data protection and cyber offences.
2. Institutional Mechanisms: Establishing agencies like CERT-In (Indian Computer Emergency Response Team), NCIIPC (National Critical Information Infrastructure Protection Centre), and I4C (Indian Cyber Crime Coordination Centre) for monitoring and response.
3. Regulatory Oversight: Setting up the Data Protection Board of India under the DPDP Act to adjudicate data breach complaints and ensure compliance.
4. Capacity Building: Running programmes like Cyber Surakshit Bharat to train government officials and Chief Information Security Officers (CISOs) in cyber hygiene.
5. Critical Infrastructure Protection: Safeguarding sectors like banking, power, and telecom through NCIIPC-led protocols for Critical Information Infrastructure.
6. International Cooperation: Engaging in cyber diplomacy and bilateral/multilateral agreements to address cross-border cybercrime and data flow issues.
7. Public Awareness: Conducting campaigns such as Cyber Jagrookta Diwas to educate citizens on safe digital practices.

(b) Data Privacy and Cyber-Security Framework in India

1. Information Technology Act, 2000 (amended 2008): Provides legal recognition to electronic transactions, defines cyber offences, and mandates compensation for data breaches under Section 43A.
2. Digital Personal Data Protection Act, 2023: Establishes a consent-based framework for processing personal data, grants rights to data principals, and creates the Data Protection Board for enforcement.
3. CERT-In Guidelines: Acts as the national nodal agency for incident response; 2022 directions mandate reporting of cyber incidents within six hours of detection.
4. NCIIPC: Protects Critical Information Infrastructure in sectors like banking, power, and telecommunications from cyber threats.
5. Sectoral Regulations: RBI and SEBI have issued master directions requiring banks, NBFCs, and market intermediaries to maintain robust cybersecurity frameworks.
6. Judicial Recognition: The Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017) recognised the Right to Privacy as a fundamental right under Article 21.
7. National Cyber Crime Reporting Portal: Enables citizens to report cybercrimes online, supported by the I4C for coordinated action across states.

Way Forward

1. Expedite notification of DPDP Rules and operationalise the Data Protection Board.
2. Strengthen CERT-In and establish sector-specific CERTs for specialised response.
3. Promote digital literacy and cyber hygiene among citizens and small businesses.
4. Foster public-private partnerships for real-time threat intelligence sharing.
5. Deepen international cooperation on cross-border cybercrime and data governance.
6. Build indigenous capabilities in cybersecurity technology and semiconductors.

Conclusion