Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{187718,
        author = {Poorna K and Harinibai. R},
        title = {Digital Twin Data Regulation : Balancing Urban Innovation and Cyber Risk in India.},
        journal = {International Journal of Innovative Research in Technology},
        year = {2025},
        volume = {12},
        number = {6},
        pages = {6911-6922},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=187718},
        abstract = {Digital twin technology (DTT) has emerged as a keystone of smart city innovation, enabling real-time digital replicas of physical infrastructure for development, monitoring and predictive analysis. By integrating sensors, cloud computing, artificial intelligence (AI) and Internet of things (IoT) devices, digital twins enhance efficiency and urban decision making. However, this interconnected ecosystem also heightens vulnerability to cyber threats such as data manipulation, hacking and corruption of AI models that can disrupt infrastructure, compromise operational data and jeopardize public safety. India’s existing legal framework remains ill- equipped to govern these risks. The Information technology Act,2000 primarily addresses e- commerce and e-governance, while the Digital personal data protection (DPDP) Act,2023 safeguards only personal data, leaving sensor-based, non-personal and machine generated datasets unregulated. The proposed Digital India Act outlines broad digital principles with no specific mechanisms for non-personal or machine generated data. The National Data Governance Framework Policy (NDGFP, 2022) is a non-binding policy draft, limited to government-held datasets, Although the Kris- Gopalakrishnan Committee Report (2020) proposed foundational principles for non-personal data governance, it remains unimplemented and silent on liability, standards and institutional safeguards. In contrast the European Union’s Data Act, 2023 establishes a comprehensive framework for both personal and non-personal data sharing, interoperability and protection. This paper argues that India requires a dedicated non-personal data governance law that operationalises the Kris committee’s recommendations, integrates cybersecurity and accountability provisions and safeguards the data infrastructure underpinning national initiatives such as the SANGAM Digital Twin.},
        keywords = {Digital Twin Technology, Cybersecurity, Non-Personal Data, Internet of things (IOT).},
        month = {November},
        }