Tamil Nadu Data Policy 2022: Gaps and Recommendations

Introduction

Tamil Nadu was among the first Indian states to formalise a comprehensive data governance framework, releasing TNDP in March 2022 with the stated aim of using "data for the public good." The policy envisions a state-level Empowered Data Governance Committee headed by the Chief Secretary, and operational decisions delegated to a Data Inter-Departmental Committee headed by the CEO of the Tamil Nadu e-Governance Agency (TNeGA), who also serves as the state's Chief Data Officer. It applies to all Public Authorities as defined under Section 2(h) of the Right to Information Act, 2005, within the state's jurisdiction.

This is meaningful ambition. But TNDP was written around the Personal Data Protection Bill, 2019 — legislation that was withdrawn in 2022 and eventually replaced by the DPDP Act, 2023. TNDP has not been updated since. What follows are four gaps this leaves open, and what closing them would require.

Gap 1 — Absence of Statutory Force

TNDP was passed as a Government Order, not through legislative means. A Government Order can guide departments internally, but it carries no penalty for violation and creates no citizen right to legal remedy if ignored. This weakens the document's ability to govern data in a sensitive manner.

The practical consequence is an odd asymmetry. TNDP applies to a wide range of government bodies handling citizen data — every Public Authority under the RTI Act's definition, operating within Tamil Nadu. Yet a resident whose data is mishandled under TNDP has no statutory complaint pathway comparable to what the DPDP Act grants against private companies. The state currently regulates private data handlers more strictly than it binds itself.

Recommendations: Ratification through the state legislature would give citizens a clear legal basis to enforce TNDP's privacy commitments, rather than relying solely on administrative goodwill. This should be paired with defined enforcement mechanisms — remedies, penalties, and a complaints pathway for citizens — and codified legal responsibilities, so TNeGA's role and departmental obligations can be audited and enforced rather than assumed.

Gap 2 — Privacy Framework

TNDP explicitly designs its privacy principles around the Personal Data Protection Bill, 2019 — legislation expected to become law but withdrawn in 2022 and reinstated as the DPDP Act 2023, built around data fiduciaries, data principals, defined consent notices, and a Data Protection Board. TNDP has not been updated to reflect any of these concepts.

The gap is concrete. Under the DPDP Rules 2025, Data Fiduciaries must provide a privacy notice in clear, plain language whenever personal data is collected on the basis of consent — explaining what data is collected, the purpose of processing, how a Data Principal can exercise their rights, and how to file a complaint with the Data Protection Board. None of this vocabulary appears in TNDP.

Worth noting for balance: DPDP's own substantive consent and notice requirements only become fully effective from 13 May 2027. Tamil Nadu currently has a genuine window to align TNDP with the national framework before it is fully operative — a proactive revision rather than a reactive scramble.

Recommendations: A revision should standardise TNDP's terminology in line with the DPDP Act 2023 — including data fiduciaries and data principals as defined categories — and update consent, breach, and governance definitions, ensuring machine-readable consent and handling protocols are specified rather than left implicit.

Gap 3 — Data Commercialisation

TNDP treats aggregated and anonymised datasets as marketable public assets, but does not address re-identification risk, data quality standards, metadata governance, retention or deletion rules, or commercial governance separate from ordinary data-sharing conditions.

TNDP's own text illustrates the gap. The policy states that the price of non-open data to be shared, if any, "would be as per the policy of the Government of Tamil Nadu," with TNeGA responsible for issuing pricing instructions — but no such instructions or accompanying re-identification safeguards appear to have been separately published. The risk is sharpened by what TNDP treats as centrally poolable in the first place: the state's "family database," a form of critical master data, is meant to be stored centrally with de-identification techniques applied. This means the dataset with the highest commercial value is also the one where re-identification risk is highest — and TNDP does not specify who tests for that risk, or how often.

Recommendations: A separate pool for commercialisation, distinct from governance data used for other purposes, should sit alongside a standalone commercialisation framework defining pricing, rules, and permitted uses. Independent re-identification risk assessments — third-party testing with published findings — should precede any dataset release, and commercial licences should set clear limits and purpose prior to release.

Gap 4 — AI Inclusion and Algorithmic Governance

TNDP does not address the governance of AI and automated decision systems built on state data. Without rules for model documentation, bias testing, human oversight, and training-data governance, algorithmic systems built on this data risk unfair outcomes and opaque decision-making.

This is less a missing clause than a structural blind spot created by timing: TNDP was finalised in March 2022, months before generative AI reshaped what "AI governance" needs to cover. The policy does describe an ambition to build a "data ecosystem for data-driven decision support system (DeTN)" — precisely the kind of system that would benefit most from the bias-testing and human-oversight standards the current draft lacks. Without that layer, a DeTN-style system risks informing decisions about welfare eligibility or service delivery with no documented standard for how the underlying model was trained, tested, or audited.

Recommendations: Training data and consent rules should prohibit using personal data for model training without a lawful basis; where aggregated data is used, re-identification testing and governance for synthetic data should be required. A dedicated AI governance section, built on accountability, transparency, fairness, safety, and human oversight, should be added rather than assumed to be covered by existing clauses.

Conclusion

TNDP has the right ambition but needs revision to align with the DPDP Act 2023 — to use data for public good, keep it safe for commercialisation, and make it ready for AI use. Because DPDP's core provisions only take full effect in May 2027, Tamil Nadu still has a working window to revise TNDP proactively, rather than being forced into a reactive scramble once the central framework is fully enforceable.

TNeGA should lead a time-bound revision involving legal counsel, independent technical review, and public consultation — preserving the policy's good intent while protecting citizens and ensuring legal compliance.