The Friction of Transparency: Reconciling the Digital Personal Data Protection (DPDP) Act, 2023 with the Public Disclosure Mandates of the FCRA

The enforcement of the Digital Personal Data Protection (DPDP) Act, 2023 marked the beginning of India’s landmark privacy-first data framework, with stringent compliance with data minimization and consent standards. Simultaneously, civil society is subjected to a high-surveillance public transparency regime under the Foreign Contribution (Regulation) Act, 2010 (FCRA). A severe statutory clash is highlighted in this article: the FCRA mandates non-profit organizations to upload granular, un-anonymised personal data including names, passport numbers, home addresses and bank accounts of trustees and donors on the public Ministry of Home Affairs (MHA) portal to trace foreign funding. Such mandatory disclosure takes place without the revocable consent of the data principal and thus, directly contravenes the data minimization and security safeguards under the DPDP Act. This article evaluates this conflict through the lens of doctrinal legal analysis and under the comparative constitution framework of the judicial ‘proportionality test’ in K.S. Puttaswamy v. Union of India (2017). The study found that tracking foreign financial flows was a legitimate state interest, but publicizing sensitive personal details failed the “necessity” and “least restrictive means” prongs of the privacy test. A constitutionally viable, less intrusive alternative is secure, closed-loop governmental audits. Thus, this article advocates for a shift to a “bifurcated registry” model that confines sensitive personal data to authorized bodies for auditing purposes, and releases only anonymized or aggregated metadata on public portals, thereby successfully balancing national security and digital privacy.