DPDP for the Secretary / Head of Department in Central government

Usually not. Section 7(b) allows the State to process personal data to give a subsidy, benefit, service, certificate, licence or permit, and Section 7(c) covers functions under law. Rule 5 then asks that this processing meet the Second Schedule standards. Consent is still needed for uses outside these, such as publicity stories or surveys not tied to the scheme.

Section 7(b) and 7(c) set the bases. Rule 5 and the Second Schedule set the standards. Section 7 · Section 4

1. Write the basis for each scheme: 7(b), 7(c) or consent.
2. Check each scheme against the Second Schedule standards.
3. Remove fields not needed for the benefit.
4. Publish a contact for questions and rights.
5. Take consent for extra uses.

• Basis register
• Standards check
• Published contact

• Taking 'consent' that citizens cannot refuse
• Collecting extra fields 'for analysis'
• No contact for questions

• What do the Second Schedule standards ask of a scheme?
• Must a ministry delete data when a citizen asks?
• What should our privacy notice say, and where must people see it?

Yes, where the scheme or a law needs it, through a written MoU or order that sets the purpose, the fields, security and retention. Share the minimum, through logged channels, and record each transfer. Bulk sharing with private parties needs a clear legal basis and should mask personal details where possible.

Section 7 bases, Section 8(1) for processors, Section 8(5) for safeguards. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6

1. List every outgoing data flow.
2. Write an MoU or order for each.
3. Cut fields to the minimum.
4. Use logged channels.
5. Review flows yearly.

• Flow register
• MoUs
• Transfer logs

• Email attachments
• Full data when counts would do
• No MoU

• What must a vendor contract say about personal data?
• What do the Second Schedule standards ask of a scheme?
• How should scheme systems handle Aadhaar numbers?

Process lawfully and only for the scheme's purpose, collect only the data needed, keep it accurate, keep it only as long as needed or required by law, protect it with reasonable safeguards, give people a contact for questions and rights, and be accountable for meeting these standards.

Rule 5 and the Second Schedule apply to State processing under Section 7(b). Section 7 · Section 8(5) · Rule 6 · Section 8(3)

1. Field review: needed or not.
2. Accuracy: how errors are corrected.
3. Retention: which schedule applies.
4. Security: who can access.
5. Contact: published on the portal.
6. Accountability: a named officer.

• Standards checklist per scheme
• Correction process
• Retention schedule

• Treating standards as a formality
• No correction route
• No named officer

• Do we need citizens' consent to run a scheme?
• Who should be able to see personal data in our systems?
• How long can we keep personal data?

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

A nodal officer with authority across divisions is the practical choice.

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

1. Name one accountable person, with a deputy.
2. Publish the contact on your website, app and notices.
3. Give the role time, a budget line and a route to management.
4. Set a short monthly report: requests, complaints, incidents, actions.
5. Review the role if you are notified as an SDF.

• Appointment letter
• Published contact
• Monthly report

• Giving the job to IT as a side task
• A contact email nobody reads
• No authority to make changes

• Could we be a Significant Data Fiduciary?
• How do we handle a privacy complaint within 90 days?
• Something has gone wrong. What happens in the first 72 hours?

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

Most effort goes into integrator contracts, access control and data flows.

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

1. Month 1: name the owner, set a budget line, start the inventory.
2. Months 2 to 3: notices, consent records, contact person, request register.
3. Months 3 to 6: vendor contracts, access control, logs, retention schedule.
4. Months 6 to 8: breach rehearsal, training, internal review.
5. Month 9: management review with evidence.

• Programme plan with owners
• Monthly status with evidence
• Management minutes

• Leaving it to the last quarter
• Buying a tool before knowing the gaps
• Status colours with no evidence behind them

• Do we need a DPO?
• Where does personal data live in our organisation?
• What must a vendor contract say about personal data?

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A leaked beneficiary list is a breach; CERT-In and the Data Protection Board both need to hear.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan

• Which logs must we keep, for how long, and where?
• What must a vendor contract say about personal data?
• Does deletion have to reach backups and test copies?

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

System integrators, NIC, state agencies and field operators process data for the department.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

• Something has gone wrong. What happens in the first 72 hours?
• Can personal data be stored or accessed outside India?
• Does deletion have to reach backups and test copies?

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

No government body had been notified as an SDF when this page was last reviewed. Large public data holders should prepare.

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

1. Estimate how many people's data you hold and how sensitive it is.
2. Note any public or security role your data plays.
3. If you are a likely candidate, run a trial impact assessment this year.
4. Identify an auditor you could appoint.
5. Watch MeitY notifications.

• Volume and sensitivity note
• Trial impact assessment
• Board note

• Assuming 'not notified' means 'never'
• Waiting for notification to start
• Thinking only tech companies will be notified

• Do we need a DPO?
• Can personal data be stored or accessed outside India?
• What should the board of directors ask management about DPDP?