DPDP for central government: ministries and departments

Ministries and departments run some of the largest personal data systems in the country: scheme beneficiaries, licences, registrations, permits and grievances. The DPDP Act applies to the State too, with specific room for its functions: Section 7(b) and 7(c) allow processing for benefits, services and functions under law without consent, and Rule 5 sets the standards that processing must meet. Section 17(4) also lifts some erasure duties. The duties of security, breach reporting, accuracy and grievance redressal still apply in full.

Open the interactive tool for this sector

Types of organisation

Ministry of Ports, Shipping and Waterways and its officesSeafarer records, port entry passes, crew lists and passenger data flow between the ministry, port authorities, DG Shipping and private terminal operators. Port systems are also likely to be critical information infrastructure, so security sits under closer watch.
Ministry of Road Transport and Highways and its officesVAHAN and SARATHI hold vehicle and licence data for crores of people. The ministry's data sharing policy of August 2025 masks personal details for most users, gives full access to police, and lets banks and insurers see personal details only with the person's consent through an OTP. That policy is the base on which DPDP work should sit.
Ministry of Chemicals and Fertilizers and its departmentsSubsidised fertiliser is sold through Aadhaar-enabled PoS devices at retailers, and every sale is captured in iFMS. That links farmer identity, land and purchase data across the department, companies and lakhs of retailers. The Department of Pharmaceuticals also runs Jan Aushadhi Kendras through private operators.
Other line ministries and departmentsMost departments hold three kinds of data: scheme or service data about citizens, staff and establishment data, and grievance or RTI records. The first is the largest and the one most often shared with states and vendors.
Citizen portals and DBT schemesDBT schemes link Aadhaar, bank accounts and eligibility data. Rule 5 and the Second Schedule set the standards: lawful, purpose-limited, necessary data only, accurate, kept only as needed, secured, with a contact for questions and rights.
Regulators and statutory bodiesRegulators collect personal data of licensees, directors, complainants and investigation subjects. Publishing orders with personal details needs care under the RTI amendment and DPDP.

Whose data you hold

Citizens and scheme beneficiaries
Licence, permit and registration holders
Officers, staff and contract staff
Vendors' personnel and consultants
Grievance and RTI applicants
Visitors to offices

Read it from your seat

Data protection nodal officerIn a ministry, you are often the first officer to look at personal data as something the department owes duties on, not just files it holds.
CISOMinistry portals and scheme systems are high-value targets, and many are run by system integrators.
IT head / NIC coordinatorYou run or oversee systems that hold data for crores of people, often through NIC and integrators.
Secretary / Head of DepartmentAs Secretary or Head of Department, you own the department's duty to citizens whose data it holds.
Oversight: AS / JS / boardIn oversight roles, your questions decide whether data protection gets attention among many priorities.
Establishment and administrationEstablishment sections hold service records, ACRs or APARs, medical and family details of officers and staff.
Legal cellThe legal cell decides which basis each scheme rests on and what contracts must say.
Office head / Section officerOffices still run on files, registers and counters as well as portals.
Scheme or programme headAs a scheme or programme head, you decide what data the scheme collects and who receives it.
Internal audit and vigilanceInternal audit and vigilance see where data handling fails.

By department

Questions specific to this sector

Practical examples

Notice, request log, retention schedule, vendor clause and breach notice.

Rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
DPDP Act, Section 7(b) and 7(c) with Rule 5 and the Second Schedule	The State may process personal data without consent to provide a subsidy, benefit, service, certificate, licence or permit, and to perform functions under law. Rule 5 asks that this processing follow the Second Schedule standards: lawful, for the stated use, limited to necessary data, accurate, kept only as long as needed, secured, and with a contact for questions and rights.	Consent is not the basis for most scheme work. The standards are, and they need evidence.	MeitY
DPDP Act, Section 17(4)	For processing by the State, Section 8(7) (erasure) and Section 12(3) (erasure on request) do not apply, and where no decision affecting the person is made, Section 12(2) does not apply either.	Retention follows public records rules rather than DPDP erasure. Security, accuracy, breach reporting and grievance duties still apply.	MeitY
DPDP Act, Section 17(2)	The Central Government may exempt notified instrumentalities for sovereignty, security, public order and related interests, and processing for research, archiving or statistics that does not lead to decisions about individuals.	An exemption applies only if notified. Do not assume it.	MeitY
RTI Act, Section 8(1)(j), as amended by DPDP Section 44(3) (in force 13 November 2025)	Personal information is now exempt from disclosure under RTI, without the earlier public-interest test.	Train CPIOs on the new wording; the amendment is being challenged before the Supreme Court, so watch for changes.	SFLC.in summary
Public Records Act, 1993 and Public Records Rules, 1997	Central government records may be destroyed only under approved record retention schedules.	Erasure of personal data in files follows these schedules, since Section 17(4) lifts DPDP erasure for the State.	National Archives of India
Aadhaar Act, 2016	Section 7 allows Aadhaar for subsidies and benefits. Section 29 limits sharing of Aadhaar numbers and core biometric information. UIDAI asks entities storing Aadhaar numbers to keep them in an Aadhaar Data Vault.	Scheme systems should store Aadhaar numbers only in a vault and show them masked.	UIDAI
CERT-In Directions, 2022 and IT Act Section 70	Report cyber incidents within six hours; keep ICT logs 180 days in India. Systems declared as protected systems under Section 70 come under NCIIPC.	Ministries and their portals follow these in addition to DPDP.	CERT-In
MeitY Email Policy and IT resources policy for Government	Official communication should use government email and approved resources.	Personal email and chat apps for files with citizen data break both these policies and DPDP safeguards.	MeitY
Guidelines for Indian Government Websites (GIGW)	Government websites must carry standard policies, including a privacy policy.	Update website privacy policies to DPDP notice standards with the contact person.	MeitY / NIC

Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.

Foundation CheckFoundation-layer control assessment DPDPiqDPDP readiness backed by evidence Compliance FabricContinuous compliance discovery DiEData Intelligence Engine aiQAI Investment Quotient