State instrumentalities carry exemptions in some directions and heightened scrutiny in others. The practical question is rarely whether an exemption applies — it is whether the body can evidence which one it relied on, and when.
DPDP sits alongside these rather than replacing them. Where a sectoral rule requires retention and the Act requires erasure, both are satisfiable — but only where the basis is recorded per attribute.
Where the pressure lands
The Act applies uniformly. The obligations that bite first do not — these are the ones this sector fails on.
Sec. 7, 17
Processing for subsidies, benefits, services, certificates, licences and permits is a listed legitimate use. Relying on it without recording the basis per activity turns a lawful position into an undocumented gap at inquiry.
Sec. 10(2)(c)(iii)
Automated decisioning that affects entitlement carries the heaviest justification burden. Model purpose, training-data provenance, bias testing and human oversight all have to be on record.
Sec. 5
Public-facing services reach citizens who are entitled to notice in any of the twenty-two Eighth Schedule languages. Serving English alone is a defect in the notice itself, not a translation backlog.
Sec. 28
The Board may require production of records. For a public body the evidence trail is also the audit trail the CAG and the legislature will ask for.
What closes them
Discovery first, because every other obligation is undeliverable without a catalogue. Everything after that consumes what it built.
Run the whole privacy programme from one control plane, so the next regulation lands as configuration.
Sec. 4, 7, 10, 16
Assess privacy & AI risk with sign-off
Sec. 10(2)
Turn compliance into audit-ready evidence
Sec. 10(2)(b)
Find and map personal data automatically
Sec. 8(3), 8(7)
Sequence
The same four phases apply in every sector; what changes is which systems go first.
Phase 1
Weeks 1–6
Phase 2
Weeks 4–12
Phase 3
Weeks 8–18
Phase 4
Weeks 14–26
Assurance and audit trails for public institutions deploying AI, with explainable detection output that stands up to oversight.
A readiness walkthrough maps what you already run onto the eighteen obligations, and names what is missing with the exposure attached.
