The Cabinet Secretary's DPDP Directive: What the Government Ordered of Itself

What Happened

On 20 August 2026, Cabinet Secretary T V Somanathan wrote to every Union government secretary and to the chief secretaries of all states and union territories. The letter directs each ministry, department and state administration to prepare a time-bound plan for implementing the Digital Personal Data Protection Act, 2023, and to put named officers behind it.

The Times of India reported it on 27 August 2026, KNN India on 29 August 2026. Both name the Cabinet Secretary, the 20 August date, and the same list of instructions.

This is the Centre’s first formal push to apply the DPDP Act to government itself. Government bodies are Data Fiduciaries under the Act, and between welfare delivery, taxation, health records and identity systems they are among the largest processors of personal data in the country. The compliance conversation has until now been pointed almost entirely at private companies.

What the Letter Asks For

Six instructions, as reported:

1. A time-bound, phased implementation plan with defined responsibilities.
2. A senior officer to own implementation, plus a nodal officer in each ministry, department and state to coordinate with the Ministry of Electronics and Information Technology.
3. Identification of personal data processing activities and preparation of data inventories.
4. Review of privacy notices, consent mechanisms where applicable, and grievance redressal systems.
5. Stronger technical and organisational safeguards, and review of contracts with third-party vendors and data processors.
6. Privacy by design in new and upgraded digital services, with legacy systems upgraded on a phased, risk-based approach.

Secretaries and chief secretaries review progress periodically. Brief status reports go back to the Cabinet Secretariat, so common problems can be handled centrally.

What the Letter Does Not Do

It sets no public deadline. Requiring a time-bound plan is not the same as fixing a date on which government becomes compliant, and no such date appears in the reported text. It names no penalty figure. It is an executive instruction to the administration, not a notification that changes the Act or the Rules.

The Data Protection Board of India has issued no penalty order to date. Read the letter as a preparation signal.

The Clock It Sits Against

The statutory dates are unchanged by the letter.

Provision	Status
DPDP Act, 2023	Law since assent in 2023
Rule 4, Consent Managers	Commences 13 November 2026
Rules 3 and 5 to 16, including notice, safeguards, breach intimation, retention and erasure, and Data Principal rights	Commence 13 May 2027
CERT-In six-hour incident reporting, under the CERT-In Directions 2022	In force today

The directive is preparatory work, timed against the 13 May 2027 commencement. It says nothing new about penalties. Those sit in the Schedule to the Act, each figure a ceiling for the obligation it names: ₹250 crore for reasonable security safeguards under Section 8(5), ₹200 crore for breach notification under Section 8(6) and again for the children obligations under Section 9, ₹150 crore for Significant Data Fiduciary obligations under Section 10, ₹50 crore residual for any other breach of the Act or the Rules.

The Same Five Items Are Your List

Strip the government context out of the letter and what remains is the readiness checklist any Data Fiduciary works through.

A plan with dates and an owner. The Act assumes a named human already. Section 6(3) requires a consent request to carry the contact details of a Data Protection Officer, where applicable, or of another authorised person who will respond. Section 8(10) requires a grievance mechanism, and Section 13 makes a Data Principal exhaust it before approaching the Board.

A data inventory. Every downstream obligation depends on it. You cannot write a notice for data you have not catalogued, cannot honour erasure on records you cannot locate, and cannot meet the 72-hour breach intimation to the Board under Rule 7 while still working out what was in the system. The data inventory is the first artefact, not the documentation written afterwards.

Notice and consent review. The notice requirements reach consent already collected, not only future collection. A notice drafted before the Rules were notified is a document to re-read.

Processor contract review. The item most private companies have not started. Section 8(1) makes a Data Fiduciary responsible for processing carried out on its behalf by a Data Processor, irrespective of any agreement to the contrary. Section 8(2) permits engaging a processor only under a valid contract, then stops. It does not prescribe that contract’s contents, which leaves every protective clause for the fiduciary to demand. The fiduciary and processor split sets out where liability lands.

Safeguards, evidenced. Section 8(5) carries the highest ceiling in the Schedule and is the obligation most often assumed rather than documented.

If You Sell To or Process Data For Government

Expect the processor-contract review to arrive as a questionnaire.

A department working through instruction 5 has to establish, for each vendor, what personal data you hold on its behalf, under what instruction, where it is stored, how long it is retained, how a breach reaches the department and on what clock, and which sub-processors sit behind you. It will also ask which of your systems feed its data inventory. Instruction 3 cannot be closed without your answer.

If the inventory and the contract already exist, that is a morning’s work. If they do not, it is not work a procurement cycle leaves room for. And this exercise now carries status reports back to the Cabinet Secretariat, which means a department that cannot answer for its vendors has to say so in writing.

Run the free DPDP Gap Assessment to see where your data inventory, notices, consent records and processor contracts stand against the same five items.

Sources

• Dipak K Dash, “DPDP Act compliance gets Cabinet Secretary’s push; ministries, states put on timeline.” The Times of India, 27 August 2026.
• KNN India, “Centre Directs Ministries, States To Prepare Time-Bound Plans For DPDP Act Compliance.” 29 August 2026.
• Digital Personal Data Protection Act, 2023: Sections 6(3), 8(1), 8(2), 8(5), 8(6), 8(10), 9, 10, 13, and the Schedule.
• Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), notified 13 November 2025): Rule 1 commencement schedule, Rule 4, Rule 7.
• CERT-In Directions, 2022, issued under the Information Technology Act, 2000.