e-Governance portals process citizen identity and service data at scale.
In short
The Act applies to the State but allows Section 17 exemptions for specified functions; where they do not apply, lawful-processing, security, rights and breach duties hold.
What changes for this sub-sector.
The State is bound by the Act, subject to notified Section 17 exemptions for specified functions.
Processing for subsidies, benefits, services and functions of the State can rely on legitimate-use grounds, not only consent.
Protect citizen data with strong safeguards and least-privilege access.
Use citizen data only for the service it was collected for.
Where not exempt, citizens can access, correct and seek erasure.
Data shared across departments needs a lawful basis and controls.
Map exemptions and lawful basis first.
The readiness check maps exemption, basis and security posture.
Take the readiness check →