To
Sri Ashwini Vaishnaw
Honourable Minister for Railways and Electronics & Information Technology
Government of India
New Delhi
Subject: Need for Clarification on Reported “Law-to-Code” Initiative under DPDPA
Dear Sir,
I draw your attention to an article published in The Economic Times dated May 20, 2026 titled “Center is Eyeing Law to Code to AI-Proof Data Law”. (Link)
According to the report, MeitY is examining the possibility of converting portions of the Digital Personal Data Protection Act into executable code-based compliance systems capable of automated decision-making relating to consent management, retention control, deletion obligations, and other compliance functions.
The article suggests that such a framework is being discussed in the context of AI-driven cyber threats and machine-speed governance requirements.
At the outset, I wish to clarify that I am not opposed to the use of AI tools, automation, or software-assisted compliance mechanisms by Data Fiduciaries. Such adoption is both commercially and technologically inevitable. However, the decision to adopt a particular compliance architecture, AI engine, or software platform must remain the responsibility of the Data Fiduciary acting as a statutory trustee of personal data.
My concern is regarding any perceived or implied endorsement by the Ministry of a particular compliance methodology, especially one that may be interpreted as converting legal obligations into pre-defined executable “smart contract”-like systems.
In my view, the following issues require careful consideration:
- Legal Interpretation Cannot Be Fully Codified
DPDPA obligations involve context-sensitive interpretation, balancing of legitimate uses, proportionality, contractual obligations, sectoral regulation, and evolving judicial principles. These cannot always be reduced into deterministic machine rules without risk of oversimplification. - Risk of Implied Government Endorsement
If MeitY is perceived as recommending or standardizing a particular AI-led compliance model, such recommendation may later be relied upon by regulated entities as a defence in enforcement proceedings. This may unintentionally dilute accountability under the Act. - Market Distortion Concerns
Any official or semi-official endorsement of specific compliance technologies may create an uneven market environment and unintentionally favour certain vendors or architectures over others. - Constitutional and Regulatory Implications
Since the constitutional validity and adjudicatory structure of the DPDPA framework are presently under judicial scrutiny, public statements suggesting automated governance replacing regulatory discretion may unintentionally complicate the Government’s legal position before the Hon’ble Supreme Court. - Need for Transparency
If consultations have indeed been conducted with industry stakeholders on this subject, it would be appropriate to place the broad consultation framework, policy objectives, and guiding principles in the public domain so that informed debate can take place.
I have elaborated some of these concerns in my earlier article titled “Calling a National Debate on Law to Code by MeitY”. (Link)
I therefore request that MeitY issue an appropriate clarification stating that:
- adoption of AI-assisted compliance tools is a matter of choice and accountability of individual Data Fiduciaries;
- the Government does not intend to replace statutory interpretation or adjudicatory discretion with automated systems;
- no implied endorsement should be inferred for any specific compliance technology, architecture, or vendor ecosystem.
I submit this representation in the larger interest of preserving confidence in the neutrality, flexibility, and constitutional robustness of the DPDPA framework.
I would appreciate a public clarification on this issue.
Yours faithfully,
Vijayashankar Nagarajarao
P.S: For better understanding, I am posting an explainer by NotebookLM in English, Kannada, Hindi and Tamil. Links are below:
Video Overview in English
Audio Overview in : English, Kannada, Hindi and Tamil
