How do the DPDP Act, 2023 and the DPDP Rules, 2025 address data minimisation and purpose limitation? Discuss their relevance to collecting identity-linked data such as caste.

The Digital Personal Data Protection (DPDP) Act, 2023 [3] came fully into force when the DPDP Rules were notified on 14 November 2025 [2]. Purpose limitation and data minimisation are among its seven core principles [1]. Together they replace "collect everything" with "collect only what a lawful purpose needs". This matters most for sensitive identity markers such as caste.

How the Act and Rules apply the two principles

• Lawful purpose: personal data may be processed only for a lawful purpose, either with consent or for certain legitimate uses [3][5].
• Purpose-bound consent: consent must be free, specific and informed. It covers only the data necessary for the specified purpose [3].
• Storage limitation: data must be erased once the purpose is served or consent is withdrawn [3].
• Itemised notice: the Rules require a separate, plain-language consent notice that states the specific purpose [1].
• Phased compliance: an 18-month window gives organisations time to redesign their systems and forms [1].

Relevance to caste and other identity data

• Necessity test: a private college or employer is a Data Fiduciary. Merit-based shortlisting does not need caste, so making caste disclosure compulsory fails the minimisation test [3].
• Judicial echo: in October 2026 the Madras HC (Madurai Bench) barred private institutions and employers in Tamil Nadu from mandatorily collecting caste details unless a statute requires it [4]. The petitioner argued that caste data at the screening stage enables discrimination [4].
• Legitimate uses survive: collection backed by a statute, such as for reservation or scholarships, remains valid [4].
• Dignity: K.S. Puttaswamy (2017) recognised informational privacy under Art. 21, which means individuals decide whether to reveal a stigmatised identity.

Gaps

• No sensitive-data tier: the 2019 Bill classed caste as sensitive. The 2023 Act protects all personal data at the same level [5].
• Coerced "optional" fields: applicants have little bargaining power, so an optional caste box may still be filled out of fear.
• Weak enforcement: enforcement depends on complaints, and full obligations apply only after the phased window ends, around mid-2027 [1].

The DPDP framework sets a necessity-and-purpose test for all personal data, and the Madurai ruling shows how that test applies to caste. Next steps should include Data Protection Board guidance that treats caste as high-risk data, keeping caste fields away from selection panels, and requiring a statutory basis for any compulsory collection. Together these would turn privacy rules into a practical safeguard for the guarantees of Arts. 15 and 17 and for SDG 10 (reduced inequalities).