Can we share data with states, banks or other ministries?

Yes, where the scheme or a law needs it, through a written MoU or order that sets the purpose, the fields, security and retention. Share the minimum, through logged channels, and record each transfer. Bulk sharing with private parties needs a clear legal basis and should mask personal details where possible.

DPDP for the Finance and accounts (FA) in Central government

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · MeitY · MeitY · MeitY · SFLC.in summary

Finance and accounts, from the Financial Adviser's office to the Pay and Accounts Office, meets DPDP in three places: the budget for the work, the integrator contracts it vets, and payment data for staff, pensioners and beneficiaries.

Written for: Finance and accounts (FA), Central government: ministries and departments. Open this seat in the interactive tool

What is different here

Beneficiary payments carry bank account details and move through PFMS, banks and states. Integrator contracts pass through finance before they are signed, which makes it a natural point to ask for data terms. Payment records are kept as the retention schedule says, not erased on request.

The first four things to sort out

Set a budget line for data protection work.
Ask for a data schedule before agreeing to any integrator contract.
Send payment files only through PFMS or bank portals.
Limit who can see salary, pension and beneficiary bank details.

A worked example

Finance and accounts (FA)

Payment files found on a shared office drive

Day 1During a routine check, the accounts section finds last year's payment files, with names and bank accounts, on a drive open to all sections.
Day 2Access is limited to the accounts section. The nodal officer is told and asks for access logs.
Week 1Logs show no access from outside the section. The nodal officer records the assessment.
AfterLocal working copies are removed once reconciliation is done; the record stays in PFMS.

Evidence kept

Finding note
Access logs
Breach assessment
Revised procedure

Payment data should live in the payment system, not in shared folders.

What others in the sector usually do. Some finance divisions now ask whether a contract has a data schedule before they give their concurrence.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Ministry of Ports, Shipping and Waterways and its offices	Port entry passes with ID copies held by many parties; Seafarer records shared with training institutes and agencies; Terminal operator systems outside the ministry's direct control
Ministry of Road Transport and Highways and its offices	Bulk or API access by private entities; Accident and challan data; Toll and FASTag transaction data with vendors
Ministry of Chemicals and Fertilizers and its departments	Aadhaar authentication at retailer PoS devices; Farmer purchase data visible to companies and dealers; Kendra operators holding prescriptions and customer details
Other line ministries and departments	Beneficiary lists published or shared in spreadsheets; System integrators with admin access; Grievance records with personal details
Citizen portals and DBT schemes	Aadhaar numbers stored outside a data vault; Bulk beneficiary data sent to states by email; Dashboards showing names and amounts publicly
Regulators and statutory bodies	Orders and filings published with personal details; Complaint data shared with regulated entities; Investigation files on shared drives

10 questions the Finance and accounts (FA) asks, answered in full

Do we need citizens' consent to run a scheme?

Short answer: Usually not; Section 7(b) or 7(c) with Rule 5 standards

Usually not. Section 7(b) allows the State to process personal data to give a subsidy, benefit, service, certificate, licence or permit, and Section 7(c) covers functions under law. Rule 5 then asks that this processing meet the Second Schedule standards. Consent is still needed for uses outside these, such as publicity stories or surveys not tied to the scheme.

What the law says

Section 7(b) and 7(c) set the bases. Rule 5 and the Second Schedule set the standards. Section 7 · Section 4

Steps

Write the basis for each scheme: 7(b), 7(c) or consent.
Check each scheme against the Second Schedule standards.
Remove fields not needed for the benefit.
Publish a contact for questions and rights.
Take consent for extra uses.

Evidence to keep

Basis register
Standards check
Published contact

Common mistakes

Taking 'consent' that citizens cannot refuse
Collecting extra fields 'for analysis'
No contact for questions

How much effort and time will it take to be ready by 13 May 2027?

Short answer: Six to nine months of steady work for most

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

From your seat: Finance and accounts (FA). Most cost is people's time and a few system changes. Budget by workstream, not by tool.

Example in Central government

Most effort goes into integrator contracts, access control and data flows.

What the law says

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

Steps

Month 1: name the owner, set a budget line, start the inventory.
Months 2 to 3: notices, consent records, contact person, request register.
Months 3 to 6: vendor contracts, access control, logs, retention schedule.
Months 6 to 8: breach rehearsal, training, internal review.
Month 9: management review with evidence.

Evidence to keep

Programme plan with owners
Monthly status with evidence
Management minutes

Common mistakes

Leaving it to the last quarter
Buying a tool before knowing the gaps
Status colours with no evidence behind them

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: Finance and accounts (FA). Contract changes with vendors are where finance and DPDP meet. Track them with procurement.

Example in Central government

System integrators, NIC, state agencies and field operators process data for the department.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

What evidence should exist before management accepts that we are ready?

Short answer: Evidence for each duty, not status colours

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

From your seat: Finance and accounts (FA). Fund evidence, not just policies. Evidence is what makes the spend count.

What the law says

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

Steps

List the duties that apply.
For each, name the piece of evidence that would satisfy an auditor.
Ask owners to attach it.
Mark duties without evidence as open, not ready.
Review the list before each management sign-off.

Evidence to keep

Duty-to-evidence list
Attached evidence
Sign-off record

Common mistakes

Accepting 'done' without seeing anything
Counting policies as evidence
One sign-off and no review after

How long can we keep personal data?

Short answer: For the legal or business period, then erase

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

From your seat: Finance and accounts (FA). Tax and audit periods are often the longest. Make sure finance records follow them and then go.

Example in Central government

Record retention schedules under public records rules decide periods.

What the law says

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps

List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.

Evidence to keep

Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates

Common mistakes

'Keep everything forever' because storage is cheap
Deleting before the legal minimum
Forgetting email, shared drives and backups

Could we be a Significant Data Fiduciary?

Short answer: Only by notification; none notified yet

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

From your seat: Finance and accounts (FA). If notification is possible, an auditor and a yearly assessment become recurring costs.

Example in Central government

No government body had been notified as an SDF when this page was last reviewed. Large public data holders should prepare.

What the law says

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

Steps

Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Identify an auditor you could appoint.
Watch MeitY notifications.

Evidence to keep

Volume and sensitivity note
Trial impact assessment
Board note

Common mistakes

Assuming 'not notified' means 'never'
Waiting for notification to start
Thinking only tech companies will be notified

Can personal data be stored or accessed outside India?

Short answer: Yes, unless a sector rule says otherwise

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

From your seat: Finance and accounts (FA). Check where finance and payroll SaaS is hosted.

Example in Central government

Hosting is usually in India; check support access by vendors' overseas teams.

What the law says

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

Steps

List where each system is hosted and where support teams log in from.
Check sector rules for localisation.
Put location and access terms in cloud and vendor contracts.
Keep the list current; new SaaS tools change it quietly.
Tell people in your notice if data goes abroad.

Evidence to keep

Hosting and access-location list
Contract clauses
Sector rule check

Common mistakes

Forgetting email, CRM and helpdesk SaaS
Ignoring overseas support logins
Assuming 'Indian vendor' means 'data in India'

Do we need consent for employee data?

Short answer: Not for employment purposes; yes for anything extra

Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.

From your seat: Finance and accounts (FA). Salary and bank details are among the most sensitive data you hold.

Example in Central government

Service records and APARs are employment data; access should be tight.

What the law says

Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. Notice, security, retention and rights still apply to employees. Section 7 · Section 5 · Rule 3 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14

Steps

List what you collect from staff and why.
Mark which items are employment purposes and which are extra.
Take consent for the extras, separately.
Give staff a short employee privacy notice.
Set retention for ex-employee records.

Evidence to keep

Employee data list with basis
Employee privacy notice
Consent for extras

Common mistakes

A blanket consent clause in the offer letter
Keeping candidate data forever
Sharing staff data with vendors without terms

Do we need a DPO?

Short answer: Not required by law unless notified as an SDF, but name one person

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

From your seat: Finance and accounts (FA). A named owner needs a budget line to be real.

Example in Central government

A nodal officer with authority across divisions is the practical choice.

What the law says

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

Steps

Name one accountable person, with a deputy.
Publish the contact on your website, app and notices.
Give the role time, a budget line and a route to management.
Set a short monthly report: requests, complaints, incidents, actions.
Review the role if you are notified as an SDF.

Evidence to keep

Appointment letter
Published contact
Monthly report

Common mistakes

Giving the job to IT as a side task
A contact email nobody reads
No authority to make changes

The sections you will use most

Section 8(1)–(2): Responsibility for vendors. System integrators, NIC and state departments that process data for a scheme act for the ministry; contracts and MoUs should say so.
Section 8(7) · Rule 8: Erasure and retention. Section 17(4) lifts DPDP erasure for the State; public records rules decide retention.
Section 7: Uses allowed without consent. Section 7(b) covers subsidies, benefits, services, certificates, licences and permits; Section 7(c) covers functions under law.
Section 10 · Rule 13: Significant Data Fiduciaries. No government body had been notified as a Significant Data Fiduciary when this page was last reviewed, though large public data holders are natural candidates.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
DPDP Act, Section 7(b) and 7(c) with Rule 5 and the Second Schedule	The State may process personal data without consent to provide a subsidy, benefit, service, certificate, licence or permit, and to perform functions under law. Rule 5 asks that this processing follow the Second Schedule standards: lawful, for the stated use, limited to necessary data, accurate, kept only as long as needed, secured, and with a contact for questions and rights.	Consent is not the basis for most scheme work. The standards are, and they need evidence.	MeitY
DPDP Act, Section 17(4)	For processing by the State, Section 8(7) (erasure) and Section 12(3) (erasure on request) do not apply, and where no decision affecting the person is made, Section 12(2) does not apply either.	Retention follows public records rules rather than DPDP erasure. Security, accuracy, breach reporting and grievance duties still apply.	MeitY
DPDP Act, Section 17(2)	The Central Government may exempt notified instrumentalities for sovereignty, security, public order and related interests, and processing for research, archiving or statistics that does not lead to decisions about individuals.	An exemption applies only if notified. Do not assume it.	MeitY
RTI Act, Section 8(1)(j), as amended by DPDP Section 44(3) (in force 13 November 2025)	Personal information is now exempt from disclosure under RTI, without the earlier public-interest test.	Train CPIOs on the new wording; the amendment is being challenged before the Supreme Court, so watch for changes.	SFLC.in summary
Public Records Act, 1993 and Public Records Rules, 1997	Central government records may be destroyed only under approved record retention schedules.	Erasure of personal data in files follows these schedules, since Section 17(4) lifts DPDP erasure for the State.	National Archives of India
Aadhaar Act, 2016	Section 7 allows Aadhaar for subsidies and benefits. Section 29 limits sharing of Aadhaar numbers and core biometric information. UIDAI asks entities storing Aadhaar numbers to keep them in an Aadhaar Data Vault.	Scheme systems should store Aadhaar numbers only in a vault and show them masked.	UIDAI
CERT-In Directions, 2022 and IT Act Section 70	Report cyber incidents within six hours; keep ICT logs 180 days in India. Systems declared as protected systems under Section 70 come under NCIIPC.	Ministries and their portals follow these in addition to DPDP.	CERT-In
MeitY Email Policy and IT resources policy for Government	Official communication should use government email and approved resources.	Personal email and chat apps for files with citizen data break both these policies and DPDP safeguards.	MeitY
Guidelines for Indian Government Websites (GIGW)	Government websites must carry standard policies, including a privacy policy.	Update website privacy policies to DPDP notice standards with the contact person.	MeitY / NIC