Who should bear the cost of digital privacy in public services? Critically analyse this with reference to digital health infrastructure in India.

Digital privacy has real costs: secure systems, trained staff and audits. The DPDP Rules, 2025 now give full effect to the DPDP Act, 2023 [1], and ABDM has linked over 104 crore health records to 93 crore ABHA accounts [2]. So the question of who pays is no longer theoretical. The answer is a cost-sharing model rather than a single payer.

Case for the State bearing the cost

• Constitutional duty: the Supreme Court in Puttaswamy affirmed privacy as a fundamental right [1]. Protection under Article 21 cannot depend on a PHC's budget.
• The State is the provider: about 65% of health professionals on ABDM are government employees [2]. Fining a public PHC, with penalties of up to ₹250 crore for weak security safeguards [1], only moves public money from one account to another and leaves the gap unfixed.
• Network security is a public good: ABDM is federated, so records stay with the facility that created them [2]. Every clinic is therefore an entry point, and the least-trained clerk sets the system's real security level.
• Economies of scale: shared tools cost less than thousands of separate purchases. C-DAC's eSushrut@Clinic already serves over 2,200 small facilities [2].

Case against a blanket State subsidy

• Private gain, public cost: insurers and corporate chains benefit from data flows, for example through NHCX [2]. Subsidising their compliance privatises the gains.
• Normal cost of doing business: like fire safety, data security is part of running a hospital. The law already calibrates the burden: Significant Data Fiduciaries must carry out independent audits and impact assessments [1].
• Fiscal trade-offs: public health budgets are tight. Fully funding compliance may weaken providers' own incentive to take security seriously.

Way forward: calibrated cost-sharing

• State: build privacy-by-design into ABDM's free software, extending its existing sandbox and mandatory security audits [2], so small clinics comply simply by using it.
• Extend the Digital Health Incentive Scheme, which has paid hospitals over ₹107 crore for digitisation [2], to cover privacy training for registration staff and ANMs.
• Large private fiduciaries pay for their own compliance.
• Use the 18-month phased-compliance window [1] for training. The Data Protection Board should favour corrective orders over fines for public facilities.

The cost of privacy should follow capacity and benefit. The State should pay for public and small providers, and large commercial data users should pay for themselves. This shared approach would turn the DPDP framework from a paper guarantee into a right patients actually enjoy, advancing SDG 3 (universal health coverage) and the promise of Puttaswamy.