Can we share data with states, banks or other ministries?

Yes, where the scheme or a law needs it, through a written MoU or order that sets the purpose, the fields, security and retention. Share the minimum, through logged channels, and record each transfer. Bulk sharing with private parties needs a clear legal basis and should mask personal details where possible.

DPDP for the Coordination / board secretariat in Central government

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · MeitY · MeitY · MeitY · SFLC.in summary

The coordination section sets the agenda for review meetings, keeps the minutes and tracks action points across divisions. That makes it the place where data protection either becomes a standing item or gets lost.

Written for: Coordination / board secretariat, Central government: ministries and departments. Open this seat in the interactive tool

What is different here

Officers rotate, so what was decided needs to be in minutes and handover notes, not in people's memory. For attached and statutory bodies, the secretariat also carries the item to their governing bodies. The record should show what evidence was seen, not only what was reported.

The first four things to sort out

Make data protection a standing item in the Secretary's monthly review.
Record the nodal officer's appointment and reporting line in an office order.
Minute the evidence seen, not just the status reported.
Add data duties to handover notes when officers move.

A worked example

Coordination / board secretariat

Data protection becomes a standing review item

Month 1After an office order names the nodal officer, the coordination section adds data protection to the monthly review agenda.
MeetingThe nodal officer shows the scheme register, integrator contracts still without data terms, and data grievances.
MinutesThe minutes record the questions asked, the documents shown and three action points with owners.
Next monthAction points are taken up first. One officer has moved, and the handover note carries the item.

Evidence kept

Office order
Agenda
Minutes with action points
Handover note

Minutes and handover notes keep the work going when officers move.

What others in the sector usually do. Some departments track data protection action points in the same tracker they use for other review items.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Ministry of Ports, Shipping and Waterways and its offices	Port entry passes with ID copies held by many parties; Seafarer records shared with training institutes and agencies; Terminal operator systems outside the ministry's direct control
Ministry of Road Transport and Highways and its offices	Bulk or API access by private entities; Accident and challan data; Toll and FASTag transaction data with vendors
Ministry of Chemicals and Fertilizers and its departments	Aadhaar authentication at retailer PoS devices; Farmer purchase data visible to companies and dealers; Kendra operators holding prescriptions and customer details
Other line ministries and departments	Beneficiary lists published or shared in spreadsheets; System integrators with admin access; Grievance records with personal details
Citizen portals and DBT schemes	Aadhaar numbers stored outside a data vault; Bulk beneficiary data sent to states by email; Dashboards showing names and amounts publicly
Regulators and statutory bodies	Orders and filings published with personal details; Complaint data shared with regulated entities; Investigation files on shared drives

What a good answer from management sounds like

Question to ask	A good answer sounds like	Effort and time
Do we need citizens' consent to run a scheme?	“Each scheme has a written basis and a standards check, and every portal shows a contact.”	Medium · 6 to 10 weeks
Can we share data with states, banks or other ministries?	“Every outgoing flow has an MoU, minimum fields and a log.”	Medium
What should the board of directors ask management about DPDP?	“DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.”	Light · one agenda item every quarter
Can management trust the DPDP position it is shown?	“The position we see separates what was tested from what was only stated, and we look at samples each quarter.”	Light · each review
Who owns accountability for personal data in practice?	“Every duty and major system has an owner who accepted it in writing, and we review the list when people move.”	Light · 2 to 4 weeks
Do we need a DPO?	“We have named an accountable person with a deputy, published the contact, and that person reports to management every month.”	Light · 2 to 4 weeks
Could we be a Significant Data Fiduciary?	“We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.”	Medium if you are a likely candidate
Something has gone wrong. What happens in the first 72 hours?	“We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.”	Medium · 4 to 8 weeks, then a yearly drill
Police, a court or a regulator asks for someone's data. What do we do?	“All authority requests go through Legal. We check the power, share only what is needed, and keep a log.”	Light · 2 to 3 weeks
How much effort and time will it take to be ready by 13 May 2027?	“We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.”	Programme · six to nine months

10 questions the Coordination / board secretariat asks, answered in full

Do we need citizens' consent to run a scheme?

Short answer: Usually not; Section 7(b) or 7(c) with Rule 5 standards

Usually not. Section 7(b) allows the State to process personal data to give a subsidy, benefit, service, certificate, licence or permit, and Section 7(c) covers functions under law. Rule 5 then asks that this processing meet the Second Schedule standards. Consent is still needed for uses outside these, such as publicity stories or surveys not tied to the scheme.

What the law says

Section 7(b) and 7(c) set the bases. Rule 5 and the Second Schedule set the standards. Section 7 · Section 4

What a good answer from management sounds like: “Each scheme has a written basis and a standards check, and every portal shows a contact.” Effort and time: Medium · 6 to 10 weeks.

Steps

Write the basis for each scheme: 7(b), 7(c) or consent.
Check each scheme against the Second Schedule standards.
Remove fields not needed for the benefit.
Publish a contact for questions and rights.
Take consent for extra uses.

Evidence to keep

Basis register
Standards check
Published contact

Common mistakes

Taking 'consent' that citizens cannot refuse
Collecting extra fields 'for analysis'
No contact for questions

What should the board of directors ask management about DPDP?

Short answer: Five plain questions, asked every quarter

Directors do not need technical detail. They need to know who is accountable, how the organisation would handle a breach, which outside parties hold data, and whether the plan to May 2027 is on track with evidence.

From your seat: Coordination / board secretariat. Put DPDP on the board calendar and minute the questions asked and answers given.

Example in Central government

Ask for the scheme register and the last rehearsal date.

What the law says

The Act places duties on the Data Fiduciary, the organisation itself. Directors oversee whether management has put those duties into practice. Section 8(1)–(2) · Section 8(6) · Rule 7 · Section 10 · Rule 13

What a good answer from management sounds like: “DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.” Effort and time: Light · one agenda item every quarter.

Steps

Ask who is accountable for personal data, by name.
Ask when the breach plan was last rehearsed and what was learnt.
Ask for the list of vendors holding the most personal data.
Ask how many requests and complaints came in, and how fast they were answered.
Ask for the plan to May 2027 with evidence, not colours.

Evidence to keep

Quarterly note to the board
Minutes showing the questions asked
Management responses

Common mistakes

Discussing DPDP once and then never again
Accepting 'IT is handling it'
No date for the breach rehearsal

Can management trust the DPDP position it is shown?

Short answer: Only as far as the evidence behind it

Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.

From your seat: Coordination / board secretariat. Minutes should record what evidence the board saw, not only what it was told.

What the law says

Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 10 · Rule 13

What a good answer from management sounds like: “The position we see separates what was tested from what was only stated, and we look at samples each quarter.” Effort and time: Light · each review.

Steps

Ask for the position split into tested, stated and not looked at.
Ask for two or three samples you can see.
Ask who reviewed the evidence.
Ask what changed since the last review.
Record the answers in minutes.

Evidence to keep

Position with tested and stated parts
Samples seen
Minutes

Common mistakes

Trusting a single summary slide
No difference between stated and tested
No record of what management saw

Who owns accountability for personal data in practice?

Short answer: Named owners, accepted by them, for each duty

The organisation is accountable under the Act, and management decides who answers for each duty inside it. In practice that means a named owner for each duty and each major system, written down and accepted by that person. An owner whose name was typed in by someone else, without their agreement, is not really an owner.

From your seat: Coordination / board secretariat. Board-approved roles avoid arguments about who owns what during an incident.

What the law says

Section 8(1) puts responsibility on the Data Fiduciary. Section 8(9) asks for a published contact person. Section 8(1)–(2) · Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

What a good answer from management sounds like: “Every duty and major system has an owner who accepted it in writing, and we review the list when people move.” Effort and time: Light · 2 to 4 weeks.

Steps

List duties and major systems.
Propose an owner for each.
Ask each owner to accept in writing.
Publish the overall contact person.
Review owners when people move.

Evidence to keep

Owner register with acceptances
Published contact
Review dates

Common mistakes

Owners assigned without telling them
One person owning everything
Owners who left the organisation

Do we need a DPO?

Short answer: Not required by law unless notified as an SDF, but name one person

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

From your seat: Coordination / board secretariat. Record the appointment and the reporting line in a board or committee resolution.

Example in Central government

A nodal officer with authority across divisions is the practical choice.

What the law says

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

What a good answer from management sounds like: “We have named an accountable person with a deputy, published the contact, and that person reports to management every month.” Effort and time: Light · 2 to 4 weeks.

Steps

Name one accountable person, with a deputy.
Publish the contact on your website, app and notices.
Give the role time, a budget line and a route to management.
Set a short monthly report: requests, complaints, incidents, actions.
Review the role if you are notified as an SDF.

Evidence to keep

Appointment letter
Published contact
Monthly report

Common mistakes

Giving the job to IT as a side task
A contact email nobody reads
No authority to make changes

Could we be a Significant Data Fiduciary?

Short answer: Only by notification; none notified yet

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

From your seat: Coordination / board secretariat. If notified, the board will need to see the impact assessment and audit each year.

Example in Central government

No government body had been notified as an SDF when this page was last reviewed. Large public data holders should prepare.

What the law says

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

What a good answer from management sounds like: “We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.” Effort and time: Medium if you are a likely candidate.

Steps

Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Identify an auditor you could appoint.
Watch MeitY notifications.

Evidence to keep

Volume and sensitivity note
Trial impact assessment
Board note

Common mistakes

Assuming 'not notified' means 'never'
Waiting for notification to start
Thinking only tech companies will be notified

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Coordination / board secretariat. Know when the board must be told about an incident, and who tells it.

Example in Central government

A leaked beneficiary list is a breach; CERT-In and the Data Protection Board both need to hear.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.” Effort and time: Medium · 4 to 8 weeks, then a yearly drill.

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

Police, a court or a regulator asks for someone's data. What do we do?

Short answer: Yes, when the request is lawful and in writing

Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.

From your seat: Coordination / board secretariat. Authority requests that reach the secretarial team need the same log as others.

Example in Central government

Requests from other agencies need a written basis and a log.

What the law says

Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences. Section 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “All authority requests go through Legal. We check the power, share only what is needed, and keep a log.” Effort and time: Light · 2 to 3 weeks.

Steps

Route every such request to Legal.
Check the authority, the legal power and the scope.
Share only what is asked, by a secure method.
Log the request, what was sent, by whom and when.
Tell the person, unless the law or the authority says you must not.

Evidence to keep

Authority request log
Copies of requests
Record of what was sent

Common mistakes

Sharing on a phone call
Sending whole files when a few lines were asked
No log

How much effort and time will it take to be ready by 13 May 2027?

Short answer: Six to nine months of steady work for most

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

From your seat: Coordination / board secretariat. A dated plan, approved by the board, makes progress easy to review.

Example in Central government

Most effort goes into integrator contracts, access control and data flows.

What the law says

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

What a good answer from management sounds like: “We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.” Effort and time: Programme · six to nine months.

Steps

Month 1: name the owner, set a budget line, start the inventory.
Months 2 to 3: notices, consent records, contact person, request register.
Months 3 to 6: vendor contracts, access control, logs, retention schedule.
Months 6 to 8: breach rehearsal, training, internal review.
Month 9: management review with evidence.

Evidence to keep

Programme plan with owners
Monthly status with evidence
Management minutes

Common mistakes

Leaving it to the last quarter
Buying a tool before knowing the gaps
Status colours with no evidence behind them

The sections you will use most

Section 8(6) · Rule 7: Telling people about a breach. Breaches must be reported to affected people and the Data Protection Board, in addition to CERT-In.
Section 10 · Rule 13: Significant Data Fiduciaries. No government body had been notified as a Significant Data Fiduciary when this page was last reviewed, though large public data holders are natural candidates.
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints.
Sections 18–26: The Data Protection Board.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
DPDP Act, Section 7(b) and 7(c) with Rule 5 and the Second Schedule	The State may process personal data without consent to provide a subsidy, benefit, service, certificate, licence or permit, and to perform functions under law. Rule 5 asks that this processing follow the Second Schedule standards: lawful, for the stated use, limited to necessary data, accurate, kept only as long as needed, secured, and with a contact for questions and rights.	Consent is not the basis for most scheme work. The standards are, and they need evidence.	MeitY
DPDP Act, Section 17(4)	For processing by the State, Section 8(7) (erasure) and Section 12(3) (erasure on request) do not apply, and where no decision affecting the person is made, Section 12(2) does not apply either.	Retention follows public records rules rather than DPDP erasure. Security, accuracy, breach reporting and grievance duties still apply.	MeitY
DPDP Act, Section 17(2)	The Central Government may exempt notified instrumentalities for sovereignty, security, public order and related interests, and processing for research, archiving or statistics that does not lead to decisions about individuals.	An exemption applies only if notified. Do not assume it.	MeitY
RTI Act, Section 8(1)(j), as amended by DPDP Section 44(3) (in force 13 November 2025)	Personal information is now exempt from disclosure under RTI, without the earlier public-interest test.	Train CPIOs on the new wording; the amendment is being challenged before the Supreme Court, so watch for changes.	SFLC.in summary
Public Records Act, 1993 and Public Records Rules, 1997	Central government records may be destroyed only under approved record retention schedules.	Erasure of personal data in files follows these schedules, since Section 17(4) lifts DPDP erasure for the State.	National Archives of India
Aadhaar Act, 2016	Section 7 allows Aadhaar for subsidies and benefits. Section 29 limits sharing of Aadhaar numbers and core biometric information. UIDAI asks entities storing Aadhaar numbers to keep them in an Aadhaar Data Vault.	Scheme systems should store Aadhaar numbers only in a vault and show them masked.	UIDAI
CERT-In Directions, 2022 and IT Act Section 70	Report cyber incidents within six hours; keep ICT logs 180 days in India. Systems declared as protected systems under Section 70 come under NCIIPC.	Ministries and their portals follow these in addition to DPDP.	CERT-In
MeitY Email Policy and IT resources policy for Government	Official communication should use government email and approved resources.	Personal email and chat apps for files with citizen data break both these policies and DPDP safeguards.	MeitY
Guidelines for Indian Government Websites (GIGW)	Government websites must carry standard policies, including a privacy policy.	Update website privacy policies to DPDP notice standards with the contact person.	MeitY / NIC