India’s Digital Personal Data Protection Act 2023 (DPDPA) treats a raw EEG signal the same way it treats a shopping cart. Both fall under the Act’s uniform Section 2(t) personal data definition. Per Namit Srivastava, Assistant Professor at CHRIST (Deemed to be University), Delhi NCR Campus, writing in LiveLaw on 30 August 2026, neither carries the enhanced consent, purpose-limitation, or impact-assessment obligations that most peer jurisdictions apply to neural data. Srivastava argues that MeitY should close this by adding neural data as a sensitive category through delegated rule-making under DPDPA Section 40, without reopening the Act.
Srivastava’s piece is legal-scholar analysis. It is not Indian government policy, and the views are his own per the article’s disclaimer. It lands two days after the 28 August 2026 announcement of ADI Neuroscience, India’s first billion-dollar neurotechnology fund, and it names an administrative-law route that MeitY could take on its own timeline.
What Srivastava proposes
Srivastava’s core proposal: India should treat data derived from direct neural measurement (EEG, functional near-infrared spectroscopy, implanted electrode signals) as sensitive by default. The mechanism is MeitY’s Section 40 rule-making power under the DPDPA, which allows the ministry to add categories of sensitive data through delegated legislation rather than through fresh primary legislation. The bundle of protections would include explicit consent, tight purpose limitation, a bar on inferring unrelated traits (emotion, politics, health) from data collected for another purpose, and mandatory Data Protection Impact Assessments for commercial neurotech deployments.
The 2018 and 2019 predecessor Bills to the DPDPA carried a “sensitive personal data” tier. The enacted DPDPA dropped it. The IT (Reasonable Security Practices and Sensitive Personal Data or Information) Rules 2011, still operative for entities outside the DPDPA’s full commencement, do not mention neural or brain-derived data. The Section 40 route would restore the sensitive-data category for neural data specifically without waiting for Parliament to reopen the primary Act.
The constitutional anchor
Srivastava’s constitutional anchor is Justice K.S. Puttaswamy v. Union of India, the Indian Supreme Court’s 2017 nine-judge bench decision recognising a fundamental right to privacy under Article 21, including what Srivastava calls “decisional and mental autonomy.” Puttaswamy did not specifically address neural data (the judgment predates commercial neurotechnology in India), but Srivastava argues its proportionality framework provides the doctrinal basis for treating direct measurements of brain activity as constitutionally significant. His argument: India does not need to wait for a Puttaswamy-style flagship judgment to move on brain data. The constitutional lever already exists in Article 21 and Puttaswamy, and the operational lever exists in Section 40.
The enforcement vacuum
Srivastava flags a practical constraint: the Data Protection Board of India, tasked with adjudicating breaches and enforcing the DPDPA, is not yet functional. Any Section 40 rule addition would land in an enforcement environment that has not yet been built out. Without a functioning Board, a rule addition is directional intent rather than operational protection.
The international comparators the piece invokes
Srivastava cites Chile’s 2021 constitutional amendment on neurorights as the leading rights-first international comparator, and references UNESCO’s move toward a recommendation on the ethics of neurotechnology. The piece does not cite the US state neural-data laws (Colorado 2024, California SB 1223 2024, Montana 2025, Connecticut SB 1295, Vermont S.71 and H.814 signed 2026).
What the piece names as India’s active deployment surface
Srivastava does not name Indian BCI operators or products. He does describe the deployment surface in generic terms: meditation applications selling EEG headbands in Indian retail; fatigue-monitoring headsets for drivers and factory workers; attention-tracking tools marketed to and piloted in Indian schools; consumer wellness meditation and sleep-tracking devices logging raw or processed EEG output on foreign servers. Cross-border transfer under DPDPA Section 16 is left to government-notified restrictions, and no data-type-specific bar currently applies. Neural data can leave India, per Srivastava’s framing, as freely as a search query unless MeitY blacklists a destination.
Where this sits alongside the ADI Neuroscience announcement
The 28 August 2026 ADI Neuroscience announcement put India onto the neurotech-capital league table with a stated US$1 billion five-year investment target under SPEC Finance India, with Russian scientific advisory from Neiry’s Alexander Panov and Moscow State University’s Mikhail Lebedev. Cross-border neural-data flow is a foreseeable operational question for any India-domiciled neurotech portfolio company with Russian scientific ties, US customers, or European clinical partners.
Srivastava’s LiveLaw piece is legal-scholar analysis published two days after the ADI Neuroscience wire. The two pieces are not linked in the LiveLaw analysis. India’s late-August 2026 neurotech story now has both a capital dimension and a policy dimension in the same week.
Where India would sit on the Issue 01 four-jurisdiction map if Section 40 rule-making happens
Issue 01 of the Dargentic Intelligence Report classified four regulatory postures: Rights-First (Chile), Horizontal Regulator (EU with AI Act and GDPR), State-Patchwork (US at the consumer-data layer), and Industrial Builder (China plus South Korea). India is currently unclassified on this map. If MeitY takes up Srivastava’s Section 40 proposal and adds neural data as a sensitive category through delegated rule-making, India would land somewhere between the Horizontal Regulator posture (regulator-led, cross-sectoral) and Rights-First (constitutional autonomy anchor). The mechanism is closer to Horizontal Regulator; the doctrinal frame Srivastava reaches for (Puttaswamy plus mental autonomy) is closer to Rights-First. Whether India adopts either or a hybrid remains a decision for MeitY.
Not disclosed
Whether MeitY has any Section 40 rule-making on neural data currently under consideration is not disclosed in the LiveLaw piece. Whether the Data Protection Board of India is on any timeline for becoming operational is not disclosed. Any Indian court case addressing neural data directly is not identified. Named Indian BCI operators or incidents that would trigger a Section 40 rule addition are not named. Whether any Indian civil society organisation, think tank, or academic institution beyond Srivastava has proposed the same Section 40 route is not identified.
What to watch
Watch whether MeitY publishes any Section 40 rule-making consultation or draft rule addressing neural data in the coming quarters. A consultation paper would be the earliest indication that Srivastava’s proposal has moved beyond legal-scholar analysis.
Watch whether the Data Protection Board of India is stood up on a defined timeline. Any Section 40 protection remains directional intent without an operational enforcement body.
Watch whether other Indian legal scholars, senior counsel, or civil society organisations publicly endorse or contest Srivastava’s Section 40 route in the next 60 to 90 days. Multiple Indian legal analyses converging on the same recommendation would shift the item from op-ed to policy conversation.
Watch whether ADI Neuroscience or another India-focused neurotech vehicle publicly addresses neural-data governance in its own materials. Capital operating in a jurisdiction with a live legal debate about the underlying data category has reason to take a public position.