Can we share data with states, banks or other ministries?

Yes, where the scheme or a law needs it, through a written MoU or order that sets the purpose, the fields, security and retention. Share the minimum, through logged channels, and record each transfer. Bulk sharing with private parties needs a clear legal basis and should mask personal details where possible.

DPDP for the Information security / SOC department in Central government

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · MeitY · MeitY · MeitY · SFLC.in summary

Whether monitoring sits with NIC, the IT cell or the integrator's SOC, the people watching alerts usually notice a problem first and start the clocks.

Written for: Information security / SOC department, Central government: ministries and departments. Open this seat in the interactive tool

What is different here

CERT-In's six-hour clock and the DPDP duty to tell affected people and the Data Protection Board run together. Many systems are run by integrators, so the department needs access to their alerts and logs. Some systems may be protected systems under Section 70, which brings NCIIPC in.

The first four things to sort out

Report reportable incidents to CERT-In within six hours.
Tell the nodal officer at once when citizen data may be involved.
Keep logs one year, and ICT logs 180 days in India.
Make sure the integrator shares alerts and logs with the department.

A worked example

Information security / SOC department

Scraping on a public application status page

11:00Monitoring shows one address range pulling thousands of records from an application status page.
11:20The range is blocked. The page shows names and partial addresses against an application number.
16:00CERT-In is informed within six hours. The nodal officer assesses it as a breach and informs the Data Protection Board.
Week 1The page now shows status only after an OTP to the registered mobile. Affected applicants are informed.

Evidence kept

Alert and timeline
CERT-In record
Breach assessment
Page change

Public search pages need limits as much as login pages do.

What others in the sector usually do. Some departments ask the integrator's SOC for a short monthly note on alerts, admin access and incidents.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Ministry of Ports, Shipping and Waterways and its offices	Port entry passes with ID copies held by many parties; Seafarer records shared with training institutes and agencies; Terminal operator systems outside the ministry's direct control
Ministry of Road Transport and Highways and its offices	Bulk or API access by private entities; Accident and challan data; Toll and FASTag transaction data with vendors
Ministry of Chemicals and Fertilizers and its departments	Aadhaar authentication at retailer PoS devices; Farmer purchase data visible to companies and dealers; Kendra operators holding prescriptions and customer details
Other line ministries and departments	Beneficiary lists published or shared in spreadsheets; System integrators with admin access; Grievance records with personal details
Citizen portals and DBT schemes	Aadhaar numbers stored outside a data vault; Bulk beneficiary data sent to states by email; Dashboards showing names and amounts publicly
Regulators and statutory bodies	Orders and filings published with personal details; Complaint data shared with regulated entities; Investigation files on shared drives

Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022

DPDP duty	Law	NIST CSF 2.0	ISO/IEC 27001 Annex A	Evidence
Know where personal data is	Section 8(5) · Rule 6	ID.AM-02, ID.AM-07	5.9, 5.12	Inventory of systems and data types, with owner and hosting location
Only the right people get in	Section 8(5) · Rule 6	PR.AA-01, PR.AA-05	5.15, 5.16, 5.18, 8.2	Role matrix, quarterly access review sign-off, leaver removal report
Strong sign-in for admins and remote users	Section 8(5) · Rule 6	PR.AA-03	5.17, 8.5	MFA enforcement report for admin, VPN and email accounts
Encrypt or mask data	Section 8(5) · Rule 6	PR.DS-01, PR.DS-02	8.11, 8.24	Encryption settings for databases, laptops, backups and transfers; masking in test copies
Keep and watch logs	Section 8(5) · Rule 6	PR.PS-04, DE.CM-01, DE.CM-03	8.15, 8.16, 8.17	Log retention settings (one year; 180 days in India for CERT-In), alert rules, NTP source
Backups that restore	Section 8(5) · Rule 6	PR.DS-11, RC.RP-03	8.13, 5.30	Backup schedule, offline copy, last restore test with date and result
Separate networks	Section 8(5) · Rule 6	PR.IR-01	8.20, 8.22	Network diagram showing segments, firewall rule review
Patch and fix weaknesses	Section 8(5) · Rule 6	ID.RA-01	8.8	Vulnerability scan results and closure tracker
Handle incidents and tell people	Section 8(6) · Rule 7	RS.MA-01, RS.CO-02, RS.CO-03	5.24, 5.25, 5.26, 6.8	Incident plan with the 6-hour and 72-hour steps, drill record, contact list
Learn from incidents	Section 8(6) · Rule 7	DE.AE-02, ID.IM-01	5.27, 5.28	Post-incident review and actions closed
Vendors protect data too	Section 8(1)–(2)	GV.SC-05, GV.SC-07	5.19, 5.20, 5.22	Contracts with data terms, vendor review record
Data comes back or is deleted at contract end	Section 8(7) · Rule 8	GV.SC-10	5.20, 8.10	Exit clause and deletion certificate from the vendor
Cloud is set up safely	Section 16 · Rule 15	GV.SC-05, PR.DS-01	5.23	Cloud region list, shared-responsibility note, configuration review
Delete when the purpose is over	Section 8(7) · Rule 8	PR.DS-01	8.10, 7.14	Retention schedule, deletion log, disposal certificates for disks and paper
People know the rules	Section 8(5) · Rule 6	PR.AT-01	6.3	Training attendance and short test results by department
Legal duties are tracked	Section 8(5) · Rule 6	GV.OC-03	5.31, 5.34	Register of laws and rules that apply, reviewed yearly
Roles are named	Section 8(9)–(10) · Rules 9, 14	GV.RR-02	5.2, 5.4	Named owners for each system and each duty, approved by management

Logs, backups and access checklist

Logs. Access and activity logs for systems holding personal data are kept for at least one year (DPDP Rule 6 and Rule 8(3)).
Logs. ICT system logs are kept for 180 days, within India, as the CERT-In Directions of 28 April 2022 require.
Logs. System clocks are synced to the NTP servers of NIC or NPL, or to servers traceable to them, as CERT-In asks.
Clocks. Reportable cyber incidents can be reported to CERT-In within six hours of being noticed.
Clocks. Affected people and the Data Protection Board are told without delay, and the Board gets a detailed report within 72 hours.
Backups. At least one backup copy is offline or immutable, and a full restore was tested in the last six months.
Backups. Backup retention matches the retention schedule, so deleted records do not live on for years in old copies.
Access. Privileged and remote accounts use multi-factor sign-in.
Access. Access rights are reviewed every quarter, and leavers are removed on their last working day.
Access. Shared or generic logins are replaced with named accounts, or are tied to a named person in a register.
Vendors. Vendor remote access is named, time-bound and logged.
Test data. Test and training systems use masked data, not live copies.
Vendor admin. Integrator admin accounts are named, use MFA, and are reported monthly.
Aadhaar. Aadhaar numbers are stored only in a vault and masked everywhere else.
Protected systems. If any system is notified under Section 70, NCIIPC requirements are tracked.

10 questions the Information security / SOC department asks, answered in full

How should scheme systems handle Aadhaar numbers?

Short answer: Vault, mask, never publish

Use Aadhaar only where a law or notification allows it, store the number only in an Aadhaar Data Vault, show it masked on screens and in reports, and never publish it. Core biometric information must never be shared. Authentication devices at the field level need vendor and operator controls.

What the law says

Aadhaar Act Sections 7 and 29 and UIDAI rules, with DPDP Section 8(5). Section 8(5) · Rule 6 · Section 7

Steps

Find every place Aadhaar numbers are stored.
Move them to a vault with reference keys.
Mask on screens, reports and files.
Check PoS and field device vendors.
Log access to the vault.

Evidence to keep

Vault design
Masking evidence
Access logs

Common mistakes

Aadhaar in spreadsheets
Full numbers on dashboards
Field operators keeping copies

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Information security / SOC department. Start the CERT-In clock and tell the DPO at once.

Example in Central government

A leaked beneficiary list is a breach; CERT-In and the Data Protection Board both need to hear.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

Which logs must we keep, for how long, and where?

Short answer: At least one year; 180 days of ICT logs in India

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

From your seat: Information security / SOC department. One year of access logs, 180 days of ICT logs in India.

Example in Central government

Integrator-run systems must give the department access to logs.

What the law says

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Sync clocks and review alerts every day.

Evidence to keep

Log source list
Retention settings
Alert review records

Common mistakes

Logging only failures, not who viewed a record
Logs stored on the same server they describe
Clocks out of sync, so timelines cannot be built

Who should be able to see personal data in our systems?

Short answer: Only those who need it, reviewed every quarter

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

From your seat: Information security / SOC department. Watch privileged and vendor accounts.

Example in Central government

Vendor admin accounts and district-level logins are the usual weak points.

What the law says

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

Steps

Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Review access every quarter with each manager.
Remove access on the last working day.

Evidence to keep

Role matrix
Quarterly review sign-offs
Leaver removal report

Common mistakes

Generic logins on shared machines
Access that only grows
No review of vendor accounts

Does a security dashboard show privacy readiness?

Short answer: Only for the security part

Not by itself. A security dashboard shows alerts, patches and controls. It does not show whether notices were given, consent was recorded, requests were answered, vendors signed terms or data was deleted on time. Use it as evidence for the security duty only.

From your seat: Information security / SOC department. A green dashboard is not evidence of privacy readiness.

What the law says

Section 8(5) is one duty among many in Sections 5 to 12. Section 8(5) · Rule 6 · Section 5 · Rule 3 · Sections 11–14 · Rule 14

Steps

Map what the dashboard covers to Rule 6.
List the duties it does not cover.
Give those duties their own evidence.
Show both to management side by side.
Avoid one overall green status.

Evidence to keep

Coverage map
Evidence for other duties

Common mistakes

Reporting a green SOC dashboard as DPDP readiness
No owner for non-security duties
One colour for everything

Does deletion have to reach backups and test copies?

Short answer: Yes, through a written backup-expiry rule

Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.

From your seat: Information security / SOC department. Test a full restore.

Example in Central government

Backups of scheme systems must be offline or immutable against ransomware.

What the law says

Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps

List where copies live: backups, replicas, test, analytics, laptops, vendors.
Set backup retention to match the retention schedule.
Write a rule: deleted records are not restored into live systems.
Mask personal data in test and training copies.
Get deletion confirmations from vendors.

Evidence to keep

Backup retention settings
Written backup-expiry rule
Masking procedure for test data

Common mistakes

Ten-year backups for convenience
Live copies in test
Restoring old backups and bringing deleted records back

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: Information security / SOC department. Monitor vendor access.

Example in Central government

System integrators, NIC, state agencies and field operators process data for the department.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

Staff share personal data on WhatsApp and personal email. What do we do?

Short answer: Yes, this is a common breach; give staff a safer option

Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.

From your seat: Information security / SOC department. Data-loss rules help; reporting routes matter more.

Example in Central government

Government email and e-Office are the approved routes; WhatsApp groups are not.

What the law says

Section 8(5) asks for reasonable safeguards. A wrong send is a breach under Section 2(u), and Section 8(6) applies. Section 8(5) · Rule 6 · Section 8(6) · Rule 7

Steps

Ask teams how they actually share files and photos today.
Provide an approved tool for that job.
Set three simple rules: approved tool, no personal accounts, report wrong sends.
Teach the rules with real examples from your own work.
Treat a quick report as good behaviour, not a disciplinary case.

Evidence to keep

Approved-tool policy
Training record
Incident reports of wrong sends

Common mistakes

A ban with no alternative
Punishing people who report
Ignoring group chats with vendors

Does ISO 27001 or NIST CSF cover our DPDP duties?

Short answer: They cover security, not the whole Act

They help a great deal with the security part. ISO/IEC 27001 and NIST CSF 2.0 are good evidence of reasonable security safeguards. They do not cover notice, consent, rights, complaints or children's data. ISO/IEC 27701 adds privacy controls, but no certificate replaces the Act.

From your seat: Information security / SOC department. Map controls once.

Example in Central government

NIC and CERT-In guidelines plus ISO 27001 for integrators cover much of Rule 6.

What the law says

Section 8(5) and Rule 6 ask for reasonable security safeguards. A recognised standard is strong evidence of that duty, and only of that duty. Section 8(5) · Rule 6

Steps

Map your current controls to Rule 6.
Add the DPDP-only items: notice, consent, rights, complaints, children, retention.
Use the same evidence for audits and for DPDP.
Include privacy in the scope of your next internal audit.
Consider ISO/IEC 27701 if clients ask for it.

Evidence to keep

Control map
Audit reports
Gap list for DPDP-only items

Common mistakes

Treating a certificate as DPDP compliance
Scope that leaves out the systems with the most personal data
No owner for the non-security duties

The sections you will use most

Section 8(5) · Rule 6: Security safeguards. Security safeguards apply in full to government systems.
Section 8(6) · Rule 7: Telling people about a breach. Breaches must be reported to affected people and the Data Protection Board, in addition to CERT-In.
Section 8(7) · Rule 8: Erasure and retention. Section 17(4) lifts DPDP erasure for the State; public records rules decide retention.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
DPDP Act, Section 7(b) and 7(c) with Rule 5 and the Second Schedule	The State may process personal data without consent to provide a subsidy, benefit, service, certificate, licence or permit, and to perform functions under law. Rule 5 asks that this processing follow the Second Schedule standards: lawful, for the stated use, limited to necessary data, accurate, kept only as long as needed, secured, and with a contact for questions and rights.	Consent is not the basis for most scheme work. The standards are, and they need evidence.	MeitY
DPDP Act, Section 17(4)	For processing by the State, Section 8(7) (erasure) and Section 12(3) (erasure on request) do not apply, and where no decision affecting the person is made, Section 12(2) does not apply either.	Retention follows public records rules rather than DPDP erasure. Security, accuracy, breach reporting and grievance duties still apply.	MeitY
DPDP Act, Section 17(2)	The Central Government may exempt notified instrumentalities for sovereignty, security, public order and related interests, and processing for research, archiving or statistics that does not lead to decisions about individuals.	An exemption applies only if notified. Do not assume it.	MeitY
RTI Act, Section 8(1)(j), as amended by DPDP Section 44(3) (in force 13 November 2025)	Personal information is now exempt from disclosure under RTI, without the earlier public-interest test.	Train CPIOs on the new wording; the amendment is being challenged before the Supreme Court, so watch for changes.	SFLC.in summary
Public Records Act, 1993 and Public Records Rules, 1997	Central government records may be destroyed only under approved record retention schedules.	Erasure of personal data in files follows these schedules, since Section 17(4) lifts DPDP erasure for the State.	National Archives of India
Aadhaar Act, 2016	Section 7 allows Aadhaar for subsidies and benefits. Section 29 limits sharing of Aadhaar numbers and core biometric information. UIDAI asks entities storing Aadhaar numbers to keep them in an Aadhaar Data Vault.	Scheme systems should store Aadhaar numbers only in a vault and show them masked.	UIDAI
CERT-In Directions, 2022 and IT Act Section 70	Report cyber incidents within six hours; keep ICT logs 180 days in India. Systems declared as protected systems under Section 70 come under NCIIPC.	Ministries and their portals follow these in addition to DPDP.	CERT-In
MeitY Email Policy and IT resources policy for Government	Official communication should use government email and approved resources.	Personal email and chat apps for files with citizen data break both these policies and DPDP safeguards.	MeitY
Guidelines for Indian Government Websites (GIGW)	Government websites must carry standard policies, including a privacy policy.	Update website privacy policies to DPDP notice standards with the contact person.	MeitY / NIC