There are some advantages of the Digital Personal Data Protection Act (DPDPA), 2023. For instance, for the first time, personal data belonging to or identifying children will have to be classified separately, with such data carrying a greater degree of security and privacy. The law also seeks to reduce the rate and impact of data breaches targeting Indian businesses.
The Digital Personal Data Protection law, however, goes a step beyond by imposing penalties for cases where data is breached as a result of a lack of implementation of adequate security controls. However, it could be said that the law isn’t balanced, because it provides wide exemptions to the processing of personal data to the government. For instance, data can be processed “in the interest of prevention, detection, investigation or prosecution of any offence ... in India.” These kinds of exemptions are dangerous as they stand to legitimise widespread and unwarranted collection of data under the guise that such collection and processing may ultimately be useful for preventing or deterring a crime.
Security agencies will have significant authority to collect and retain any data whatsoever, as is typically the case with exemptions relating to the maintenance of sovereignty, integrity, security of the state, preservation of public order, prevention of offences, and incitement to commit offences. The law also exempts processing of personal data held outside of India. The government is also exempt from being required to delete any data that it possesses, regardless of the purpose it may have been collected for, on the request of an individual, or by way of a prescribed data retention period.
The government is not bound by purpose limitations, allowing data collected for one specified purpose to be used for a new, incompatible purpose, which stands in contrast to the regulations imposed on businesses.
Mr. Lal was suffering from a rare disease and the data relating to that was collected by the government. Suppose the DPDPA, 2023 provides exemptions for the government relating to data deemed “necessary for research, archiving or statistical purposes” if the personal data is not to be used to take any decision specific to a data principal and such processing is carried on in accordance with such standards as may be prescribed. Which of the following is most appropriate?
Correct Answer :
The personal data of Mr. Lal can be preserved by the government till the research on rare disease is complete.
Solution :
The correct answer is: The personal data of Mr. Lal can be preserved by the government till the research on rare disease is complete.
Step-by-Step Explanation:
1. Understanding the Premise & Given Exemption:
The passage discusses the exemptions provided to the government under the Digital Personal Data Protection Act (DPDPA), 2023. Specifically, the question introduces a scenario where data collected by the government is deemed "necessary for research, archiving or statistical purposes", provided it is not used to take specific decisions regarding the individual (data principal) and is processed in accordance with prescribed standards.
2. Analyzing Option 1:
"The personal data of Mr. Lal can be preserved by the government till the research on rare disease is complete."
Since the data was collected for research on a rare disease, the stated exemption explicitly allows the government to retain/preserve and process personal data for research purposes without the standard strict deletion requirements that apply to private businesses. Therefore, preserving this data until the research is complete directly aligns with the research exemption.
3. Analyzing Option 2:
"The data can only be used for taking any decision regarding Mr. Lal."
This directly contradicts the exemption condition stated in the prompt, which specifies that the processing is allowed "if the personal data is not to be used to take any decision specific to a data principal".
4. Analyzing Option 3:
"The personal data of Mr. Lal’s health conditions and his personal data can be preserved by the private hospital forever and used for research by them without his consent."
The prompt and passage focus on wide exemptions given to the government, not private entities/hospitals. Private businesses remain bound by strict regulations, purpose limitations, and consent requirements.
Conclusion:
Hence, Option 1 is the most appropriate statement based on the provided text and statutory context.
Access expert-curated educational resources and study materials—completely free.
Create, conduct, and manage professional online assessments with Mindyard. Perfect for teachers and institutes.
Copyright © 2026 Mindyard. All Rights Reserved.
