International Data Privacy Day

1. At a Glance

International Data Privacy Day (Data Protection Day) observed annually on 28 January to raise public awareness on protection of personal data in the digital age [S1].
Designated in 2006 by the Council of Europe to mark the signing of Convention 108 — the world's first legally binding international treaty on data protection [S1].
For UPSC, the day is a hook for GS-II (rights, governance) and GS-III (cyber security, digital economy) — anchoring India's DPDP Act, 2023 and DPDP Rules, 2025 regime [S1][S2].

2. Why in the News

PIB Backgrounder (27 Jan 2026) released ahead of Data Privacy Day 2026 highlighting India as the 3rd-largest digitalised economy and reaffirming the citizen-centric DPDP framework [S1].
DPDP Rules, 2025 notified on 14 November 2025 by MeitY, operationalising the DPDP Act, 2023 with an 18-month phased compliance timeline [S2].
Union Budget 2025–26 earmarked ₹782 crore for cybersecurity to safeguard Digital Public Infrastructure (DPI) [S1].

3. Background & Evolution

1981: Council of Europe opens Convention 108 for signature — first binding data-protection treaty [S1].
2006: Council of Europe designates 28 January as Data Protection Day; later adopted globally as Data Privacy Day [S1].
2017: Justice K.S. Puttaswamy v. Union of India — Supreme Court declares Right to Privacy a fundamental right under Article 21 [S1].
2023 (11 August): Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) enacted by Parliament [S3].
Jan 2025: Draft DPDP Rules released; 6,915 inputs received from citizens/stakeholders during consultation [S4].
14 Nov 2025: DPDP Rules, 2025 notified, fully operationalising the Act [S2].

4. Core Static Facts

Observance date: 28 January (annually) [S1].
Originating body: Council of Europe (2006); rooted in Convention 108 (1981) [S1].
Nodal ministry (India): Ministry of Electronics and Information Technology (MeitY) [S3].
Statutory framework: DPDP Act, 2023 + DPDP Rules, 2025 [S2][S3].
Design philosophy: SARAL — Simple, Accessible, Rational, Actionable [S2].
Seven core principles: consent & transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, accountability [S2].
Regulator: Data Protection Board of India (DPBI) — fully digital institution; appeals to TDSAT (Telecom Disputes Settlement and Appellate Tribunal) [S2].
Cybersecurity allocation: ₹782 crore (Budget 2025–26) [S1].
India's digital economy rank: 3rd largest globally [S1].

5. Multi-Dimensional Analysis

Legal / Constitutional - Operationalises Article 21 right to privacy per Puttaswamy (2017) via statutory backing [S1]. - DPDP Act balances privacy with RTI's transparency mandate [S2].

Scientific / Technological - DPBI built as a fully digital, paperless body with online filing & mobile app for grievance tracking [S2]. - Phased 18-month compliance window for Data Fiduciaries to upgrade systems [S2].

Social - Verifiable consent mandatory before processing children's data; carve-outs only for healthcare, education, real-time safety [S2]. - Standalone, plain-language consent notices for citizen comprehension [S2].

Economic - Underpins trust in India's 3rd-largest digital economy; protects DPI (Aadhaar, UPI, DigiLocker) [S1]. - Compliance costs offset by predictable rules for innovation & cross-border data flows [S1].

Governance / Administrative - Shared responsibility model: government + digital platforms + citizens [S1]. - Appellate route: DPBI → TDSAT keeps adjudication tech-specialised [S2].

6. Recent Developments (last 12-18 months)

3 Jan 2025: MeitY releases Draft DPDP Rules, 2025 for public consultation (deadline 18 Feb 2025) [S4].
Feb 2025: 6,915 inputs received on draft Rules [S4].
Feb 2025: Union Budget 2025–26 allocates ₹782 crore for cybersecurity [S1].
14 Nov 2025: DPDP Rules, 2025 notified [S2].
27 Jan 2026: PIB Backgrounder for International Data Privacy Day [S1].

7. Prelims Hooks

Data Privacy Day observed on 28 January [S1].
Designated in 2006 by Council of Europe [S1].
Marks anniversary of Convention 108 (1981) — first binding data-protection treaty [S1].
DPDP Act, 2023 is Act No. 22 of 2023, enacted 11 August 2023 [S3].
Nodal ministry: MeitY (not Ministry of Home Affairs) [S3].
Design philosophy acronym: SARAL [S2].
Regulator: Data Protection Board of India; appeals lie to TDSAT (not High Court directly) [S2].
DPDP Rules notified on 14 November 2025 with 18-month phased compliance [S2].
₹782 crore for cybersecurity in Budget 2025–26 [S1].
India = 3rd-largest digitalised economy globally [S1].
Right to Privacy is a fundamental right under Article 21 (Puttaswamy, 2017) [S1].
DPDP Act has 7 core principles [S2].
Draft Rules drew 6,915 public inputs [S4].

8. Mains Relevance

GS-II: Government policies, citizens' rights (Right to Privacy); statutory bodies (DPBI).
GS-III: Cyber security, digital economy, Digital Public Infrastructure.
Probable stems: 1. "Discuss how the DPDP Act, 2023 and DPDP Rules, 2025 operationalise the Puttaswamy verdict while balancing innovation and transparency." (GS-II) 2. "Examine the institutional architecture of the Data Protection Board of India. How does it differ from a conventional regulator?" (GS-II) 3. "Cybersecurity is integral to a trusted Digital Public Infrastructure. Analyse India's policy and budgetary response." (GS-III)

9. Related Topics to Study Next

Puttaswamy Judgment (2017) — constitutional foundation of privacy.
Digital Public Infrastructure (DPI) — Aadhaar/UPI/DigiLocker ecosystem the Act protects.
TDSAT — appellate forum for DPBI orders.
RTI Act, 2005 — interaction/tension with DPDP Act on disclosure [S2].
Cyber Surakshit Bharat / CERT-In — cybersecurity operational arms.
GDPR (EU) — comparative international benchmark.
B.N. Srikrishna Committee (2017) — predecessor to DPDP framework.
Convention 108+ — modernised Council of Europe treaty.

10. Common Errors / Trap Areas

Wrong date: Some confuse with Safer Internet Day (Feb) — Data Privacy Day is 28 January.
Wrong origin: Designated by Council of Europe, NOT the EU/UN.
Wrong ministry: DPDP is under MeitY, not MHA or Ministry of Communications.
Appeal route: From DPBI appeals go to TDSAT, not directly to High Court / Supreme Court.
DPDP Act year vs Rules year: Act = 2023; Rules notified = 2025 (14 Nov).

11. Sources

[S1] International Data Privacy Day — PIB Backgrounder, 27 Jan 2026 — https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2219070&reg=3&lang=2 — (tier: 1)
[S2] DPDP Rules, 2025 Notified — PIB, 14 Nov 2025 — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655 — (tier: 1)
[S3] The Digital Personal Data Protection Act, 2023 — MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf — (tier: 1)
[S4] Draft DPDP Rules, 2025 — 6,915 inputs — PIB — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2148944 — (tier: 1)