Reimaging Data protection for the Marginalized: Why India’s Digital Policies Must Prioritize the Vulnerable First

Written by Setu Kumar Rai & Tanisha Nath students at National Law University, Meghalaya.

Introduction

India’s digital revolution has transformed commerce, education, governance, and social interaction at an unforeseen speed. From the introduction of Aadhar in 2009 to the large-scale adoption of 4G networks in the late 2010s, more than 820 million Indians now regularly use the internet from a mere 250 million in 2014 , yet this growth remains geographically, gender-wise, caste-wise, and income-wise unevenly distributed. While the urban hubs enjoy average broadband speeds of 50 Mbps, numerous rural districts still fight for 2 Mbps connections, with some panchayats reporting a complete lack of reliable service. This dichotomy fuels a digital divide that both constrains opportunity and makes marginalized populations increasingly vulnerable to data exploitation in the absence of proper safeguards, individual information like biometric data, financial transactions, health records can be gathered, abused, or weaponized by state and corporate actors. 

Across the world, regulations like the European Union’s General Data Protection Regulation (GDPR) have increased the standards of individuals’ rights, requiring transparency, consent, and minimization of data. These, however, assume an architecture of digital literacy and agency as a given ,privileges that are simply not available to millions of Indians, particularly women, rural dwellers, and economically poor constituencies. As India is finishing its Digital Personal Data Protection (DPDP) Bill, 2023, it is at a crossroads: mimic global standards or lead a “vulnerability-first” approach that centers the interests of the least empowered in its data governance. This blog pleads for the latter drawing out the digital divide in India, discussing the increased risks faced by marginalized groups, critiquing current legislations, and presenting tangible, inclusive policy reform suggestions. 

The Digital Divide in India

India’s base of internet users grew from 400 million in 2017 to more than 820 million as of the end of 2023, yet penetration is persistently skewed. The Telecom Regulatory Authority of India’s 2021 report estimated urban internet penetration at 72%, versus only 38% in the countryside. In Jharkhand and Bihar, rural connectivity had fallen as low as 24%, whereas Kerala and Punjab had more than 60% rural coverage. Such differences are rooted in the infrastructure deficit—only 42% of Indian villages were covered by 4G by 2022—and the affordability barrier, with rural users paying an average of ₹130 per month for data, compared to ₹250 in cities.

Indian women are disproportionately impacted by the digital divide. Based on GSMA’s 2020 Mobile Gender Gap report, just 37% of Indian women use mobile internet—approximately 20 percentage points behind men. Socio-cultural values restrict women’s mobility and education, hindering both access to technology as well as digital literacy training. Smartphone ownership is still taboo for women in certain patriarchal rural communities, while safety issues and online harassment additionally deter women from joining online.

Exclusion based on caste adds to these disparities. Scheduled Castes (SCs) and Scheduled Tribes (STs) have average internet adoption of 30% and 28%, respectively far less than the overall national average. Poorer households, which incur less than ₹150 a month on data, must make a choice between basic internet connectivity and irreducible necessities. Additionally, digital literacy programs frequently go to waste in marginalized hamlets since NGO and government outreach efforts target more accessible and denser areas.

Vulnerability of Marginalized Groups in the Digital Ecosystem

In K.S. Puttaswamy v. Union of India, the Supreme Court of India affirmed privacy as a fundamental right under Articles 14, 19, and 21 of the Constitution. Yet the subsequent rollout of Aadhaar—a biometric database covering over 1.3 billion residents—underscored the perils of large-scale data collection without adequate safeguards. Although Aadhaar aimed to streamline welfare delivery, authentication failures disproportionately impacted rural residents. In Rajasthan, 15% of users experienced failed authentications due to worn fingerprints; in Tamil Nadu, women laborers with manual-skill-induced fingerprint erosion faced a 20% higher failure rate than men.

When we speak, these failures have grave material effects, denial of rations, pension payments, and LPG subsidies, services essential for subsistence. Privacy International’s December 2021 report highlights that over 2 million individuals faced service exclusion in 2020 alone, primarily from marginalized castes and remote hamlets. Unable to navigate complex grievance-redress mechanisms or contest data inaccuracies, these citizens endure bureaucratic limbo.

Beyond state surveillance, private platforms routinely harvest user data under opaque consent clauses. Economically disadvantaged users—unaware of the implications—click “agree” on lengthy, jargon-laden terms to access essential mobile banking or health apps. The result: granular behavioral profiles used for targeted marketing, micro-credit algorithms that penalize the poor, and risk assessments that reinforce existing socioeconomic biases.

International human-rights organizations underscore that vulnerable groups worldwide suffer similar fates. Access Now’s 2023 report documents how indigenous communities in Latin America faced algorithmic profiling for resource allocation, while African informal workers were excluded from digital lending services due to biased credit scoring models. These global parallels reinforce the urgency for India to design data protection that explicitly shields its most vulnerable cohorts.

Evaluation of India’s Digital Laws 

The Digital Personal Data Protection Bill, 2023

The DPDP Bill, tabled in Parliament in August 2023, is India’s effort to legislate data protection principles. The main provisions are:

• Consent-based processing (Bill § 5): Personal data processed only with clear, informed consent.
• Data minimization and purpose limitation (Bill § 6): Controllers are required to collect data only as needed and use it only for stated purposes.
• Breach notification (Bill § 12): Obligatory notification to the Data Protection Authority of India (DPAI) within 72 hours of a breach.

These are GDPR principles closely adhered to, though there is still much to be done about marginalized users:

• Assumed Digital Competence- The Bill mandates electronic consent through web interfaces (§ 5), taking for granted the ability of users to access digital forms and understand legalese. In practice, rural and low-literacy communities are unlikely to have both digital literacy and language competence (much of the consent is in English or Hindi).
• Lack of Vulnerability Impact Assessments – In contrast to GDPR’s Data Protection Impact Assessments (Article 35), which necessitate controllers assessing high-risk processing, the DPDP Bill has no direct requirement for socio-economic “vulnerability assessments.”²⁴ Without that, data projects might inadvertently be focusing on marginalized groups without assessing potential harms.
• Limited Enforcement Mechanisms – The Bill projects a centralized DPAI with investigative functions (§ 20), but has no separate department allocated for rural and marginalized area compliance monitoring. Initial budgets allocate merely 5% of funds to outreach and capacity building, threatening under-allocation to grassroots monitoring.

Comparative International Frameworks

• Brazil’s LGPD (2018): Mandates “clear and adequate” communication tailored to vulnerable audiences, and requires controllers to present consent forms in simple Portuguese, with optional audio-visual explanations.
• Kenya’s Data Protection Act (2019): Embeds privacy impact assessments for national ID systems and allocates funding for digital literacy programs in arid and semi-arid regions.
• Canada’s Privacy Impact Assessments (PIAs): While not statutory, PIAs are required for federal government projects, with published reports subject to parliamentary scrutiny.

These examples demonstrate that embedding equity provisions—accessible communication, mandatory impact assessments, dedicated oversight—yields more inclusive outcomes.

Policy Proposals for Inclusive Digital Reform

To make data protection meaningfully benefit India’s most marginalized, the following practical reforms are essential:

1. Community-Oriented Digital Literacy Initiatives

2. Multimodal Consent Mechanisms

Design: Implement Interactive Voice Response (IVR) technology in local languages, visual consent cards, and in-app audio descriptions. Spain’s Data Protection Authority pilot of elderly audio-visual consent resulted in a 40% increase in informed assent.

3. Mandatory Vulnerability Impact Assessments (VIAs)

4. Committed Grassroots Oversight Division under DPAI

Organizational Structure: Create a “Marginalized Communities Unit” comprised of rural development, women’s rights, and tribal affairs experts.

Function: Carry out field audits, operate helplines, and submit bi-annual reports to Parliament on data protection compliance in under-served areas.

5. Incentivize Inclusive Design through Grants and Certifications

Grants: Provide capacity-building grants to civil-society organizations and startups that are creating privacy-enhancing tech for low-resource environments.

Certifications: Establish a “Vulnerability-Sensitive Data Handler” certification, similar to GDPR’s Binding Corporate Rules, which identifies entities that implement best practices for marginalized users

6. International Cooperation and Knowledge-Sharing

Partnerships: Institutionalize monthly exchanges with Access Now, Privacy International, and peers in Brazil, Kenya, and Canada to keep guidelines current and share best practices.

Annual Report: Release an annual “State of Vulnerable Data Protection” report comparing India’s performance to global peers.

Conclusion

India’s path towards a digitally empowered nation is at a turning point. With more than 820 million people online, yet just 38% rural coverage and 37% female access, there is a dramatic digital divide that reflects entrenched social disparities. The DPDP Bill, 2023, provides a hopeful start, consent requirements, data minimization, and breach notices indicate India’s commitment towards international best practices. However, without deliberate, vulnerability-centric design, these measures risk serving only those already positioned to exercise digital agency.

A genuinely inclusive data protection regime should advance beyond harmonization; it should focus on those with the weakest voice to assert their information rights. By integrating community-driven digital literacy, multimodal consent mechanisms, Vulnerability Impact Assessments as a mandatory requirement, and separate oversight for marginalized communities, India can build a trailblazing “vulnerable-first” model. This way, not only will the rights of rural dwellers, women, and caste-marginalized be protected, but also the social contract among the state, private sector, and citizens will be fortified.

Finally, data protection is no technical or legal hurdle—it is a matter of social justice. As policymakers gather to green light the DPDP Bill, integrating these recommendations will turn India’s legislation into a force for equity rather than a checkbox exercise. The future calls for harmonization among legislators, regulators, civil society, and excluded communities themselves to ensure that as India charts its digital future, no one is left behind.

References

1. Pew Research Ctr., Internet Usage in India: Trends and Disparities, 2017,  https://www.pewresearch.org/internet/2017/03/07/digital-divides-in-emerging-economies/
2. TRAI, Report on Internet Access in India, 2021, https://www.trai.gov.in/sites/default/files/Report_on_Internet_Access_in_India.pdf. 
3. Ookla, Speedtest Global Index, India, Dec. 2023, average broadband speed 50 Mbps vs. rural 2 Mbps, https://www.speedtest.net/global-index/india. 
4. Id. 
5. NASSCOM, The State of Digital in India 2020,  https://nasscom.in/knowledge-center/publications/state-digital-india-2020. 
6. GSMA, The Mobile Gender Gap Report 2020, https://www.gsma.com/mobilefordevelopment/resources/the-mobile-gender-gap-report-2020/. 
7. MOSPI, Household Social Consumption: Education in India, 75th Round (July 2017–June 2018), Tables 14–15
8. NASSCOM, supra note 4
9. K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1
10. Id.
11. Press Information Bureau, Digital India Programme: Service Exclusions, GOI Press Release (Aug. 2021)
12. Privacy International, How Privacy Infringement in India Affects Vulnerable Groups (Dec. 12, 2021), available at https://privacyinternational.org
13. Access Now, Data Protection Laws: A Global Perspective (Jan. 15, 2023), available at https://www.accessnow.org.
14. World Bank, Digital Economy for Africa Initiative, 2021, at 4
15. Access Now, supra note 12.
16. Digital Personal Data Protection Bill, 2023, Ministry of Electronics & Information Technology, available at https://www.meity.gov.in.
17. Centre for Internet & Society, Policy Brief: DPDP Bill 2023 (Apr. 2024 
18. Regulation (EU) 2016/679, 2016 O.J. (L 119) 1 (General Data Protection Regulation)  Ministry of Electronics & IT, Expenditure Estimates for DPDP Implementation, 2023 Budget Documents 
19. Lei Geral de Proteção de Dados (LGPD), Law No. 13.709, §§ 6–7 (Brazil, 2018).
20. Kenya Data Protection Act, No. 24 of 2019, §§ 28–30.
21. Office of the Privacy Commissioner of Canada, Guide to Privacy Impact Assessments (2014)
22. NITI Aayog, Strategic Digital Transformation of India: Policy Recommendations, 2021, https://www.niti.gov.in
23. Spanish Data Protection Agency, Audio-Visual Consent Pilot Study, AEPD Reports (2022).