Two developments in November 2025 reveal that while India urgently wants to align with global data standards, its administrative culture may prevent it from achieving digital modernity. On November 13, the Ministry of Electronics and IT gave effect to the Digital Personal Data Protection (DPDP) Act of 2023 by notifying rules for its application. They prescribe protocols for data fiduciaries ― entities which collect and process the data of individuals ― to handle their holdings, including rules for preserving and deleting data. A fortnight later, on November 28, the Ministry of Communications asked cellphone manufacturers to pre-install their products with the government’s Sanchar Saathi app. It helps users to check a device’s IMEI, report lost or stolen phones and report attempts at phone fraud.

Both functions are essential. India needs to integrate with the global digital communications regime and crack down on crime which uses telecom services. The country has the world’s largest population, estimated to be 1.46 billion, 1.2 billion of whom are mobile phone users. It also has among the world’s biggest second-hand and grey markets for phones. The incidence of social engineering crimes using phones is high, and makes headlines because it targets people in affluent countries, like Americans, apart from Indians. Phishing and fraud are so commonplace that there’s even a Netflix serial about it: Jamtara ― Sabka Number Ayega. The small town of Jamtara in the state of Jharkhand is India’s phishing capital.

Patently, the government has legitimate reasons to pursue data compliance and transparency, but perhaps it has gone too far. Critics point out that DPDP should have been applied to sectors of the economy which process consumer data in volumes, like banking and civil aviation, and to the government itself, which has the biggest silos of personal data. Instead, it passed an umbrella law which covers even journalism and the Right to Information, which seek to expose privately held data in the public interest. If a newspaper publishes leaked data on corporate malfeasance without the permission of the corporation in question, it would be on the wrong side of the new law. And if it did seek permission, would the story ever be published? The Editors’ Guild of India is seeking a clarification.

Sanchar Saathi arrogated blanket permissions to itself, far in excess of what its stated purpose required. The app can read a phone user’s messages and call logs, and shoot pictures and video with their phone’s camera. And according to the order issued by the government, it could not be disabled or deleted by the user. Potentially, it was hard-coded government spyware installed in every user’s pocket. The government protested that it would not spy. But it could, and that was unsettling enough. Opposition leaders like Priyanka Gandhi affirmed the citizen’s right to privacy, and the government looked like Peeping Tom.

Eventually, the government rolled back the app, but it took it a couple of days to understand that it should not look like a snoop. This owes to an entrenched perception problem in the corridors of power. Indians woke up to the idea of privacy with the arrival of the public internet in India in 1995, but administrators persisted in believing ― as their colonial predecessors had done ― that the government should enjoy panopticonic access to all information about its subjects, in order to exert enlightened control.

This mentality, a throwback to pre-digital times, persists to the present day. The Income Tax Bill, 2025 was passed in March. It will come into force in the next financial year, giving tax authorities the automatic power to access emails, social media, cloud storage and online financial accounts of persons suspected of tax evasion. Tax cases are the favoured weapon of Indian governments against critics and opponents, because the onus of disproving the accusation is upon the defendant. And from next year, merely making an accusation would give the government access to all the digital communications of the defendant, opening the door to fishing expeditions whose catch could put Jamtara’s phishing buccaneers to shame.

Apple has immediately refused to install Sanchar Saathi on iPhones to protect the privacy of its users. So what? BlackBerry had resisted pressures from the Indian government to give “lawful access” to its encrypted messenger and email traffic, after a devastating terrorist attack on Mumbai in 2008 ― India’s 9/11 ― was coordinated using BlackBerry phones. It caved in 2010-11, and started withdrawing from the smartphone market in 2016. The loss of its USP of bulletproof security, which was valued by CEOs and heads of government, was a factor in its eclipse.

India has also pressured WhatsApp for access, but perhaps fruitlessly, because of a design feature. The service uses a fresh keypair for every conversation, plus other cryptographic features, so that even if a single chat is cracked, all the others remain safe.

Bringing India’s data protocols up to world standards is a priority. The Adani Group has secured a deal for Google’s biggest AI campus outside the US, which will be established in Visakhapatnam, and the government wants to make India an AI computing hub. But transnationals won’t park their data in India without acceptable standards, especially privacy guarantees. The government can’t promise privacy through the DPDP Act, and simultaneously seek free access to phone users’ data via Sanchar Saathi, on the plea of security. It does not inspire confidence, the universal lubricant which oils the wheels in all international economic and strategic matters.