Examine the governance and privacy concerns in inter-departmental data sharing through APIs for statistical purposes.

On 29 September 2026 the Ministry of MSME and MoSPI exchanged an MoU. Under it, unit-wise Udyam data will flow through a two-way API to build the National Statistical Business Register (NSBR) [1]. API links make statistics faster and more complete, but they also raise governance and privacy questions that need safeguards.

Governance concerns

• Weak legal footing: an MoU is an administrative arrangement, not a statute [1]. Its rules on who is liable and how disputes are settled cannot be enforced in court.
• Inherited data quality: Udyam is self-declared, and no documents are uploaded. The only check is against PAN and GSTIN [2]. Closed firms seldom deregister, so errors pass into the register and into survey frames.
• Fragmented registries: MoSPI's Compendium lists many administrative registries [4], but India has no common business identifier across them. Matching and removing duplicate units remains unresolved.
• Accountability: the public does not know which fields are shared, who can see unit-level records, or how long data is kept. A two-way flow also blurs which ministry is the data fiduciary.
• Single-source dependence: UN Guidelines advise building business registers from several administrative sources [3]. A registry that firms join voluntarily cannot give full coverage alone.

Privacy concerns

• Proprietorships = persons: most micro units are sole proprietorships. Their PAN, address and turnover are personal data under the DPDP Act, 2023.
• Function creep: use is limited to "statistical purposes" [1], but a two-way channel could let identifiable data flow back to officials for tax or enforcement use. That would breach statistical confidentiality (UN Fundamental Principles of Official Statistics).
• Re-identification: location, industry and turnover taken together can identify small firms even after names are removed.
• Informed consent: units registered to get benefits, not to be counted. Reusing their data without telling them fails the Puttaswamy (2017) proportionality test.

Way forward

• Give data sharing statutory backing through a clear legal framework for statistical data sharing.
• Publish the API protocol: which fields are shared, access logs and retention periods.
• Follow "data in, aggregates out": identifiable records flow only into the statistical system, and only aggregates come back.
• Build privacy in from the start: pseudonymised identifiers and independent audits.
• Add a yearly active-status check that uses the existing IT and GST link [2].

API-based sharing can make India's statistics more timely and granular, but the trust it depends on has to be built on purpose. Statutory backing, open protocols and confidentiality by design would make the NSBR a credible tool for evidence-based policy, in keeping with the Article 21 right to privacy and SDG 17.18 on statistical capacity.