The Digital Personal Data Protection (DPDP) Act of 2023 introduces a regulatory framework for data governance in India, with Section 36 granting the State authority to compel the disclosure of information from data fiduciaries and intermediaries.

2023 年的《數位個人資料保護法》(DPDP Act) 為印度的數據治理引入了一套監管框架，其中第 36 條賦予國家權力，可以強制數據受託者與中介機構披露資訊。

The operational utility of Section 36 is predicated on the necessity of State intervention to mitigate corporate negligence and criminal exploitation. Proponents argue that the provision serves as an essential enforcement mechanism, enabling the Data Protection Board to secure access logs and compliance documentation during data breaches in the fintech, ed-tech, and digital lending sectors. Such capabilities are framed as a prerequisite for ensuring citizen redress and the deletion of unlawfully processed data. Furthermore, it is asserted that these powers are consistent with existing regulatory authorities, such as those held by the Reserve Bank of India, and are subject to judicial review under Articles 32 and 226 of the Constitution.

第 36 條的實際用途是基於國家有必要介入，以減輕企業的疏忽與刑事剝削。支持者認為，該條文是一個至關重要的執法機制，使數據保護委員會在金融科技、教育科技與數位貸款領域發生數據洩漏時，能夠獲取存取日誌與合規文件。此類能力被視為確保公民獲得救濟以及刪除非法處理數據的前提。此外，有人主張這些權力與現有監管權限（例如印度儲備銀行所擁有的權限）是一致的，且受憲法第 32 條與第 226 條的司法審查監督。

Conversely, critical perspectives emphasize the breadth of the provision's language and the potential for executive overreach. Rule 23 of the DPDP Rules 2025 expands the scope of 'information' to include software and databases, while permitting the non-disclosure of such requests to the affected data principals under the aegis of national security. This lack of transparency is contextualized by recent executive actions involving Telegram and WhatsApp, which critics suggest reflect a trend of rapid, notice-based restrictions. Comparative analysis indicates that jurisdictions such as the European Union and Brazil employ more stringent 'necessity and proportionality' tests and independent oversight mechanisms to govern state access to personal data.

相反地，批評觀點強調該條文措辭過於寬泛，具有行政權力過度擴張的潛在風險。《2025 年 DPDP 規則》第 23 條將「資訊」的範圍擴大到包含軟體與資料庫，同時允許在國家安全之名下，不必向受影響的數據主體披露此類請求。由於近期涉及 Telegram 與 WhatsApp 的行政行動，反映出一種快速以通知為基礎的限制趨勢，使得這種缺乏透明度的情況更加顯著。比較分析顯示，如歐盟與巴西等司法管轄區，在管理國家獲取個人數據時，會採用更嚴格的「必要性與比例性」測試以及獨立的監督機制。

Currently, the Supreme Court of India is reviewing the constitutionality of Section 36. The central legal tension resides in whether the provision adheres to the trifecta of legality, necessity, and proportionality established in Justice K. S. Puttaswamy (Retd.) v. Union of India. While the legal basis is established, the absence of prior judicial approval and the broad definition of national security interests have led to calls for reform. Proposed modifications include the implementation of semi-judicial oversight for security requests and mandatory notifications to the Data Protection Board to ensure a more robust check on executive discretion.

目前，印度最高法院正在審查第 36 條的合憲性。法律爭議的核心在於，該條文是否符合在 K. S. Puttaswamy (Retd.) 訴印度聯邦案中所確立的「合法性、必要性與比例性」三要素。雖然法律基礎已經確立，但由於缺乏事先的司法批准，加上對國家安全利益的定義過於寬泛，導致外界要求改革。建議的修改方案包括為安全請求實施準司法監督，以及強制通知數據保護委員會，以確保對行政裁量權有更強而有力的制衡。

Section 36 remains a point of contention between the requirements of state security and individual privacy rights, with its final application pending judicial determination before the Act's full implementation in May 2027.

第 36 條仍是國家安全需求與個人隱私權之間的爭議焦點，其最終應用將取決於該法案在 2027 年 5 月全面實施前的司法裁定。