India - Data Governance Framework

Overview

The Draft India Data Accessibility and Use Policy (published 21 February 2022) and the subsequent Draft National Data Governance Framework Policy (published 26 May 2022) represent MeitY's iterative policy effort to make government-held non-personal and anonymized datasets more discoverable and usable for research, startups and intragovernmental purposes. The May 2022 draft reframes and narrows the earlier approach by removing explicit market‑pricing/monetisation provisions and by proposing a governance and implementation architecture centered on an India Data Management Office (IDMO) and an "India Datasets" platform. The drafts aim to standardize metadata, APIs, anonymisation and risk assessment tools to support a "whole-of-government" data ecosystem, while preserving privacy, security and legal compliance as core principles. See the MeitY draft and official government statement for the authoritative text and status updates: Draft National Data Governance Framework Policy (MeitY, May 2022) and Press Information Bureau release (27 Jul 2022).

Definitions

The drafts distinguish: (a) non-personal data — datasets that do not permit identification of an individual; (b) anonymized data — data that has undergone techniques intended to prevent re-identification; (c) India Datasets programme — a curated repository of anonymized non-personal data for research and startups; and (d) IDMO — the central coordinating office proposed under Digital India Corporation for rule‑making, standards and platform management. The drafts propose domain‑specific metadata, "high-value datasets" classification, a negative list (non-shareable datasets) and restricted access categories to govern release and reuse.

Governance and Institutional Framework

The central institutional design in the May 2022 draft places the IDMO within the Digital India Corporation under MeitY with responsibilities to design the India Datasets platform, issue technical rules/standards (metadata, anonymisation, retention), operate a dataset request processing mechanism and coordinate with line ministries, states and industry. Every ministry/department is expected to create Data Management Units (DMUs) led by Chief Data Officers (CDOs) to operationalize standards, prepare datasets for inclusion, and manage intra‑governmental sharing. Consultative bodies and periodic multi‑stakeholder consultations are foreseen to refine guidelines and maintain dialogue with industry and states; the IDMO is required to consult ministries and stakeholders semi‑annually according to the draft. The proposal anticipates rule‑making powers delegated to IDMO for operational standards, though primary statutory enforcement remains with central law and future data protection legislation. (Official statement: Press Information Bureau; draft text: MeitY draft.)

Key Focus Areas

The drafts emphasize multiple programmatic priorities: (1) Open-by-default government data with defined exceptions; (2) Standardisation — metadata schemas, APIs and interoperability across ministries to enable "whole-of-government" integration; (3) Privacy and anonymisation — mandatory application of anonymisation techniques and risk-assessment toolkits prior to dataset release; (4) India Datasets programme — creation of curated anonymized datasets available via IDMO-authorized platforms for Indian researchers, startups and government users; (5) Risk-managed access — a tiered access model with open, restricted and negative-list categories, plus secure processing environments for sensitive analytics; (6) Capacity building — DMUs, training and national standards to strengthen data stewardship across departments; (7) Voluntary private-sector contribution — an encouragement model (not mandatory) for private actors to onboard non-personal datasets into the India Datasets programme; and (8) Alignment with legal frameworks — ensuring that data sharing occurs within existing national laws and in anticipation of future data protection rules.

Implementation Framework

Operationalisation in the May draft centers on IDMO tasks: build and operate the India Datasets platform, publish rulebooks and toolkits (anonymisation, data quality, retention), define APIs and technical standards, process dataset requests (including researcher/startup access), and coordinate DMUs/State Data Officers. Ministries are expected to inventory datasets, classify them against the negative/restricted lists, implement metadata and API endpoints, and channel dataset requests through the IDMO platform. The draft also envisages technical controls including secure enclaves, audit trails, licensing/terms-of-use templates and citation/attribution obligations for dataset users. For G2G access, a separate standard mechanism is to be developed by IDMO to streamline inter‑departmental exchange.

Monitoring and Evaluation

The draft proposes periodic reporting by IDMO on dataset inclusions, requests processed, usage patterns, anonymisation audits and compliance checks. IDMO is expected to publish performance scorecards and hold semi‑annual stakeholder consultations to review standards and operational friction points. Data quality indicators, timeliness, API uptimes and request turnaround times form part of monitoring metrics. The draft recommends independent audits of anonymisation processes and an escalation mechanism for suspected re‑identification or misuse to ensure trust and continual improvement.

Penalties, Liability, and Appeals

The May 2022 draft focuses on governance, standards and access procedures but does not establish a broad novel penal code for data misuse; instead it contemplates administrative sanctions, revocation of platform access, contractual remedies under dataset license terms and escalation to existing law enforcement or regulator frameworks (e.g., actions under the IT Act or future data protection law). The draft envisages that IDMO will define compliance obligations and remedial processes, while determinations of criminal liability or regulatory fines will remain governed by applicable national statutes and sectoral rules until specific enforcement rules are prescribed.

Relationship to Other Instruments

The drafts are explicitly designed to complement existing Indian instruments: the National Data Sharing and Accessibility Policy (NDSAP 2012), Open Government Data initiatives, the Information Technology Act 2000 and ongoing discussions on data protection and digital personal data laws. The May draft also references the 2020 Expert Committee report on Non‑Personal Data (Kris Gopalakrishnan Committee) and seeks to operationalize several recommendations while removing some contested provisions (notably monetisation) present in the February draft. The framework envisions harmonisation with sectoral data regimes and international guidelines as implementation proceeds.

International Alignment

MeitY's drafts seek to align technical and governance standards with international best practice on anonymisation, data interoperability and cross‑border legal obligations, while prioritizing a domestic repository of India‑specific datasets for research. The policy signals intent to coordinate with international frameworks for privacy-preserving analytics and with multilateral digital economy initiatives, but it also emphasizes national data sovereignty and domestic researcher/startup access as primary objectives. Implementation design includes compatibility with internationally recognized anonymisation and security standards to facilitate potential future cross‑jurisdictional collaboration.

Implementation Timeline

Sources and References