Mumbai, February 6 : In a significant step towards strengthening privacy, security, and accountable governance in the digital era, the Information Technology Department, Government of Maharashtra organised a high-level workshop on the Digital Personal Data Protection (DPDP) Act, 2023 and the forthcoming rules at Sahyadri Guest House, Malabar Hills, Mumbai on 5th February 2026.
The workshop brought together senior government officers, law enforcement leaders, legal experts, and technology and privacy professionals to build a shared understanding of the DPDP framework and its implications for government departments, public digital platforms, and citizen-centric service delivery.
With the rapid expansion of digital public services across sectors such as health, education, welfare delivery, and financial inclusion, government systems increasingly handle large volumes of citizens’ personal data. This digital transformation has created enormous benefits in terms of efficiency and reach—yet it has also increased exposure to cyber threats, data breaches, and misuse.
The DPDP Act and the upcoming rules represent a defining shift in how institutions must collect, store, process, and protect personal data. The workshop was therefore organised to ensure that officers across departments understand their legal obligations, strengthen internal governance mechanisms, and build a culture of privacy-by-design and security-by-default in public administration.
Citizens must have rightful control over their own data
– Chief Secretary Rajesh Agarwal
Delivering the keynote address, Chief Secretary, Government of Maharashtra Shri Rajesh Agarwal, IAS, underlined that cyber security, data ownership, and data protection are closely linked, yet separated by a fine line. Recalling his tenure as Principal Secretary IT 12–13 years ago, he noted that cyber security has now become a major governance challenge, and in the DPDP era, every data leak can directly invite penalties.
He made a strong case that privacy alone is not enough—data ownership is even more important, and citizens must have rightful control over their own data.
Sharing an example from Pune, he said that even revenue-related judgments delivered by tehsildars must be accessible to citizens, and clarified that transparency in governance is not a violation of data protection. He emphasised that data protection and transparency must coexist responsibly.
Comprehensive clean-up through data impact assessments
– Principal Secretary Brijesh Singh
Highlighting the operational and enforcement implications of the DPDP Act, Shri Brijesh Singh, DGIPR Principal Secretary, Government of Maharashtra, said: “DPDP Act has fundamentally changed the way we work—because today, everything is data. Across apps and platforms, consent is often bundled and unclear. We must redesign how we collect, store, and use data, and ensure it is purpose-limited and truly necessary—especially when it involves children, women, and other vulnerable groups.”
He further stressed that many systems collect far more data than required and called for a comprehensive clean-up through data impact assessments, review of legacy databases, and stronger safeguards. He emphasised that even in government schemes, consent must be taken case-by-case, and with grievance mechanisms in place, responsibility becomes serious—particularly for citizens below 18, where parental consent is mandatory.
Department must adopt transparent, ethical, and accountable data practices
– Secretary Shri Virendra Singh
Speaking on the evolving responsibilities of government institutions, Shri Virendra Singh, IAS, IT Secretary, Government of Maharashtra, said: “Digital Personal Data Protection (DPDP) Act and the forthcoming rules mark a defining shift in the way government institutions must treat citizens’ data—especially in high-impact areas like health, education, and financial inclusion.”
Shri Singh said, “As we build digital public services at scale, our responsibility becomes even greater: to protect privacy, ensure purpose-based use, and maintain the highest standards of security. Public trust is the foundation of public administration.
Therefore, every department must adopt transparent, ethical, and accountable data practices, moving closer to a robust governance framework that safeguards citizens while enabling efficient service delivery.”
Advocate Ms. Khushbu Jain, Supreme Court of India, highlighted the constitutional foundation of the DPDP Act and said: “The Supreme Court has clearly established that the Right to Privacy is a fundamental right. When there is zero transparency, there is zero accountability—leading to a state of lawlessness. The 2017 privacy judgment laid the foundation, and the DPDP Act carries that principle forward by asserting a simple idea: take my permission.”
She explained that under the law, personal data cannot be collected without consent, and consent must be freely given, explicit, and provided in a language listed in the Eighth Schedule. She also highlighted citizens’ rights to know what data is collected and for what purpose, access their data, withdraw consent, and request erasure.
A detailed technical and legal presentation was delivered by Team Legasis—Suhas Tuljapurkar, Dinesh Pillai, and Ishan Tuljapurkar—focusing on DPDP compliance, institutional roles, and emerging intersections with AI-driven technologies.
Their session highlighted why the DPDP Act is a game-changer for India’s digital ecosystem and explained the Act’s key features and the new privacy governance framework. The presentation clearly outlined the roles of key stakeholders, including Parliament, the Data Protection Board, State instrumentalities, Data Fiduciaries, Significant Data Fiduciaries, Data Principals, Consent Managers, and Data Protection Officers (DPOs).
The session detailed core principles such as lawful purpose, consent, data minimisation, accuracy, security safeguards, mandatory breach reporting, and accountability, stressing that accountability lies with the officer-in-charge, not vendors alone.
The workshop strongly underlined the DPO’s role as central to privacy governance, covering:
• Compliance monitoring and internal controls
• Risk assessment and privacy impact evaluation
• Grievance redressal mechanisms
• Liaison with regulators
• Awareness-building across departments
The workshop concluded with a vote of thanks by Shri Sanjay Sripatrao Katkar, Managing Director, MahaIT, who appreciated the participation of speakers and officers and reiterated MahaIT’s commitment to supporting the Government of Maharashtra in implementing secure, citizen-first digital governance frameworks.
IAS and IPS officers, senior Govt officials of Government of Maharashtra and senior functionaries from MahaIT were present during the workshop.
