Reader Privacy Under the Digital Personal Data Protection Act, 2023: Contextual Integrity and the Obligations of Indian Academic Libraries

Abstract

The Digital Personal Data Protection Rules, 2025, notified in November 2025, brought India’s first comprehensive data protection statute into operation, with full compliance required by May 2027. Every academic library in India is a processor of digital personal data on a substantial scale, and most are constituent units of institutions that will be data fiduciaries under the Act, yet the professional literature contains almost no analysis of what the statute requires of them. This paper provides that analysis. It applies Nissenbaum’s theory of contextual integrity, together with the proportionality standard established in Puttaswamy, to argue that library records are not simply personal data among other categories but records of intellectual inquiry, whose disclosure produces a chilling effect that a consent-based compliance regime does not by itself prevent. The method is documentary policy and legal-instrument analysis, conducted through a transparent selection protocol yielding a corpus of 81 documents. The paper develops a systematic inventory of the personal data processed by a typical Indian academic library across four categories, maps each category against the requirements of the Act, and analyses four hard cases: users under the age of eighteen, where section 9 forbids the tracking and monitoring of behaviour despite consent; federated authentication under the One Nation One Subscription scheme, which hands over institutional identity to commercial publishers; vendor and publisher analytics, where the library asserts it has no control over data it has caused to be created; and closed-circuit television and biometric attendance, where a proportionality analysis is necessary and is not often conducted. It is argued that the Act protects library users less than the professional standards of IFLA and the American Library Association, that its amendment of the Right to Information Act weakens rather than strengthens accountability, and that compliance alone will not discharge the profession’s obligation. Twelve recommendations follow.