InfraVeritas360DPDPiq

DPDP Insights › Central government: ministries and departments › IT department

Central government: ministries and departments

DPDP for the IT department in Central government

IT and NIC teams run portals, email and e-Office.

Open this seat in the interactive tool

What is different here

Ministries and departments run some of the largest personal data systems in the country: scheme beneficiaries, licences, registrations, permits and grievances. The DPDP Act applies to the State too, with specific room for its functions: Section 7(b) and 7(c) allow processing for benefits, services and functions under law without consent, and Rule 5 sets the standards that processing must meet. Section 17(4) also lifts some erasure duties. The duties of security, breach reporting, accuracy and grievance redressal still apply in full.

The first four things to sort out

  1. System list with hosting.
  2. Vendor admin control.
  3. Logs one year, 180 days in India.
  4. Secure transfers.

A worked example: An old portal still online

  1. Week 1IT finds a retired portal still serving data.
  2. Week 2It is taken offline.
  3. Week 4Data is archived under the schedule.
  4. AfterA decommissioning checklist is written.

Evidence kept: Finding; Archive record.

Old portals leak data.

What others in the sector usually do. Monthly admin access reports.

Where it usually goes wrong, by organisation type

Organisation typeHotspots
Ministry of Ports, Shipping and Waterways and its officesPort entry passes with ID copies held by many parties; Seafarer records shared with training institutes and agencies; Terminal operator systems outside the ministry's direct control
Ministry of Road Transport and Highways and its officesBulk or API access by private entities; Accident and challan data; Toll and FASTag transaction data with vendors
Ministry of Chemicals and Fertilizers and its departmentsAadhaar authentication at retailer PoS devices; Farmer purchase data visible to companies and dealers; Kendra operators holding prescriptions and customer details
Other line ministries and departmentsBeneficiary lists published or shared in spreadsheets; System integrators with admin access; Grievance records with personal details
Citizen portals and DBT schemesAadhaar numbers stored outside a data vault; Bulk beneficiary data sent to states by email; Dashboards showing names and amounts publicly
Regulators and statutory bodiesOrders and filings published with personal details; Complaint data shared with regulated entities; Investigation files on shared drives

Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022

DPDP dutyLawNIST CSF 2.0ISO/IEC 27001 Annex AEvidence
Know where personal data isSection 8(5) · Rule 6ID.AM-02, ID.AM-075.9, 5.12Inventory of systems and data types, with owner and hosting location
Only the right people get inSection 8(5) · Rule 6PR.AA-01, PR.AA-055.15, 5.16, 5.18, 8.2Role matrix, quarterly access review sign-off, leaver removal report
Strong sign-in for admins and remote usersSection 8(5) · Rule 6PR.AA-035.17, 8.5MFA enforcement report for admin, VPN and email accounts
Encrypt or mask dataSection 8(5) · Rule 6PR.DS-01, PR.DS-028.11, 8.24Encryption settings for databases, laptops, backups and transfers; masking in test copies
Keep and watch logsSection 8(5) · Rule 6PR.PS-04, DE.CM-01, DE.CM-038.15, 8.16, 8.17Log retention settings (one year; 180 days in India for CERT-In), alert rules, NTP source
Backups that restoreSection 8(5) · Rule 6PR.DS-11, RC.RP-038.13, 5.30Backup schedule, offline copy, last restore test with date and result
Separate networksSection 8(5) · Rule 6PR.IR-018.20, 8.22Network diagram showing segments, firewall rule review
Patch and fix weaknessesSection 8(5) · Rule 6ID.RA-018.8Vulnerability scan results and closure tracker
Handle incidents and tell peopleSection 8(6) · Rule 7RS.MA-01, RS.CO-02, RS.CO-035.24, 5.25, 5.26, 6.8Incident plan with the 6-hour and 72-hour steps, drill record, contact list
Learn from incidentsSection 8(6) · Rule 7DE.AE-02, ID.IM-015.27, 5.28Post-incident review and actions closed
Vendors protect data tooSection 8(1)–(2)GV.SC-05, GV.SC-075.19, 5.20, 5.22Contracts with data terms, vendor review record
Data comes back or is deleted at contract endSection 8(7) · Rule 8GV.SC-105.20, 8.10Exit clause and deletion certificate from the vendor
Cloud is set up safelySection 16 · Rule 15GV.SC-05, PR.DS-015.23Cloud region list, shared-responsibility note, configuration review
Delete when the purpose is overSection 8(7) · Rule 8PR.DS-018.10, 7.14Retention schedule, deletion log, disposal certificates for disks and paper
People know the rulesSection 8(5) · Rule 6PR.AT-016.3Training attendance and short test results by department
Legal duties are trackedSection 8(5) · Rule 6GV.OC-035.31, 5.34Register of laws and rules that apply, reviewed yearly
Roles are namedSection 8(9)–(10) · Rules 9, 14GV.RR-025.2, 5.4Named owners for each system and each duty, approved by management

Logs, backups and access checklist

9 guides for the IT department, in full

How should scheme systems handle Aadhaar numbers?

Short answer: Vault, mask, never publish

Use Aadhaar only where a law or notification allows it, store the number only in an Aadhaar Data Vault, show it masked on screens and in reports, and never publish it. Core biometric information must never be shared. Authentication devices at the field level need vendor and operator controls.

From your seat: IT department. Search shared drives for Aadhaar numbers.
What the law says

Aadhaar Act Sections 7 and 29 and UIDAI rules, with DPDP Section 8(5). Section 8(5) · Rule 6 · Section 7

Steps
  1. Find every place Aadhaar numbers are stored.
  2. Move them to a vault with reference keys.
  3. Mask on screens, reports and files.
  4. Check PoS and field device vendors.
  5. Log access to the vault.
Evidence to keep
  • Vault design
  • Masking evidence
  • Access logs
Common mistakes
  • Aadhaar in spreadsheets
  • Full numbers on dashboards
  • Field operators keeping copies
Related questions

Can we share data with states, banks or other ministries?

Short answer: Yes, with a written basis, minimum fields and a log

Yes, where the scheme or a law needs it, through a written MoU or order that sets the purpose, the fields, security and retention. Share the minimum, through logged channels, and record each transfer. Bulk sharing with private parties needs a clear legal basis and should mask personal details where possible.

What the law says

Section 7 bases, Section 8(1) for processors, Section 8(5) for safeguards. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6

Steps
  1. List every outgoing data flow.
  2. Write an MoU or order for each.
  3. Cut fields to the minimum.
  4. Use logged channels.
  5. Review flows yearly.
Evidence to keep
  • Flow register
  • MoUs
  • Transfer logs
Common mistakes
  • Email attachments
  • Full data when counts would do
  • No MoU
Related questions

Where does personal data live in our organisation?

Short answer: Start with one row per system

Usually in more places than anyone expects: core systems, email, shared drives, laptops, vendor systems, backups, test copies, spreadsheets and paper. A simple inventory, one row per system, is the base for every other duty.

From your seat: IT department. IT holds the system list. Add personal-data columns to it rather than starting a separate spreadsheet.
In Central government

Start from the scheme list and the systems behind each.

What the law says

Every duty in Sections 5 to 12 assumes you know where the data is. Rule 6 needs safeguards for each system, and Section 11 needs you to find the data when someone asks. Section 8(5) · Rule 6 · Sections 11–14 · Rule 14 · Section 8(7) · Rule 8

Steps
  1. List systems, then shared drives, email, spreadsheets and paper stores.
  2. For each one, note whose data, which items, purpose, owner, hosting location and vendors.
  3. Add copies: backups, test, analytics.
  4. Get each owner to confirm their rows.
  5. Update it whenever a system is bought or retired.
Evidence to keep
  • Data inventory
  • Owner confirmations
  • Change log
Common mistakes
  • A 200-column spreadsheet nobody finishes
  • Leaving out SaaS tools bought by departments
  • No owner for each row
Related questions

Which logs must we keep, for how long, and where?

Short answer: At least one year; 180 days of ICT logs in India

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

From your seat: IT department. Set retention on every log source: one year for DPDP, and 180 days in India for CERT-In.
In Central government

Integrator-run systems must give the department access to logs.

What the law says

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps
  1. List systems holding personal data and what each logs today.
  2. Turn on access logging where it is missing.
  3. Send logs to one protected store, with at least one year of retention.
  4. Keep a copy of ICT logs in India for at least 180 days.
  5. Sync clocks and review alerts every day.
Evidence to keep
  • Log source list
  • Retention settings
  • Alert review records
Common mistakes
  • Logging only failures, not who viewed a record
  • Logs stored on the same server they describe
  • Clocks out of sync, so timelines cannot be built
Related questions

Who should be able to see personal data in our systems?

Short answer: Only those who need it, reviewed every quarter

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

From your seat: IT department. Run the quarterly access review with system owners and close leavers on the last day.
In Central government

Vendor admin accounts and district-level logins are the usual weak points.

What the law says

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

Steps
  1. Write a role matrix for each key system.
  2. Replace shared logins with named accounts.
  3. Use multi-factor sign-in for admin and remote access.
  4. Review access every quarter with each manager.
  5. Remove access on the last working day.
Evidence to keep
  • Role matrix
  • Quarterly review sign-offs
  • Leaver removal report
Common mistakes
  • Generic logins on shared machines
  • Access that only grows
  • No review of vendor accounts
Related questions

Does deletion have to reach backups and test copies?

Short answer: Yes, through a written backup-expiry rule

Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.

From your seat: IT department. Write the backup-expiry rule and mask test data. These two steps close most deletion gaps.
In Central government

Backups of scheme systems must be offline or immutable against ransomware.

What the law says

Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps
  1. List where copies live: backups, replicas, test, analytics, laptops, vendors.
  2. Set backup retention to match the retention schedule.
  3. Write a rule: deleted records are not restored into live systems.
  4. Mask personal data in test and training copies.
  5. Get deletion confirmations from vendors.
Evidence to keep
  • Backup retention settings
  • Written backup-expiry rule
  • Masking procedure for test data
Common mistakes
  • Ten-year backups for convenience
  • Live copies in test
  • Restoring old backups and bringing deleted records back
Related questions

Can personal data be stored or accessed outside India?

Short answer: Yes, unless a sector rule says otherwise

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

From your seat: IT department. List cloud regions and overseas support logins. Keep the list current.
In Central government

Hosting is usually in India; check support access by vendors' overseas teams.

What the law says

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

Steps
  1. List where each system is hosted and where support teams log in from.
  2. Check sector rules for localisation.
  3. Put location and access terms in cloud and vendor contracts.
  4. Keep the list current; new SaaS tools change it quietly.
  5. Tell people in your notice if data goes abroad.
Evidence to keep
  • Hosting and access-location list
  • Contract clauses
  • Sector rule check
Common mistakes
  • Forgetting email, CRM and helpdesk SaaS
  • Ignoring overseas support logins
  • Assuming 'Indian vendor' means 'data in India'
Related questions

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: IT department. IT usually notices first. Know the first-hour steps and who to call.
In Central government

A leaked beneficiary list is a breach; CERT-In and the Data Protection Board both need to hear.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps
  1. Name one incident lead and a back-up, with phone numbers that work at night.
  2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
  3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
  4. Decide in advance who signs off each message.
  5. Rehearse once a year with the people who would actually be called.
Evidence to keep
  • Incident plan with clocks
  • Rehearsal record
  • Incident log with times of each step
Common mistakes
  • Waiting to finish the investigation before telling anyone
  • Treating a wrong email or a lost laptop as 'not a breach'
  • Only IT knowing the plan
Related questions

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: IT department. Check vendor access is named, time-bound and logged.
In Central government

System integrators, NIC, state agencies and field operators process data for the department.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps
  1. List vendors who receive or can see personal data.
  2. Rank them by how much and how sensitive.
  3. Add a data-protection schedule to each contract, starting with the top ten.
  4. Ask for evidence: certificates, test results, deletion confirmations.
  5. Review the top vendors every year.
Evidence to keep
  • Vendor register
  • Signed data-protection schedules
  • Annual review notes
Common mistakes
  • Relying on the vendor's standard terms
  • No incident-notice time
  • No exit and deletion clause
Related questions

Practical examples

Notice wording, request log, retention schedule, vendor clause and breach notice for central government: ministries and departments.

The sections you will use most

Other rules that sit alongside DPDP

RuleWhat it saysWhat it means alongside DPDPSource
DPDP Act, Section 7(b) and 7(c) with Rule 5 and the Second ScheduleThe State may process personal data without consent to provide a subsidy, benefit, service, certificate, licence or permit, and to perform functions under law. Rule 5 asks that this processing follow the Second Schedule standards: lawful, for the stated use, limited to necessary data, accurate, kept only as long as needed, secured, and with a contact for questions and rights.Consent is not the basis for most scheme work. The standards are, and they need evidence.MeitY
DPDP Act, Section 17(4)For processing by the State, Section 8(7) (erasure) and Section 12(3) (erasure on request) do not apply, and where no decision affecting the person is made, Section 12(2) does not apply either.Retention follows public records rules rather than DPDP erasure. Security, accuracy, breach reporting and grievance duties still apply.MeitY
DPDP Act, Section 17(2)The Central Government may exempt notified instrumentalities for sovereignty, security, public order and related interests, and processing for research, archiving or statistics that does not lead to decisions about individuals.An exemption applies only if notified. Do not assume it.MeitY
RTI Act, Section 8(1)(j), as amended by DPDP Section 44(3) (in force 13 November 2025)Personal information is now exempt from disclosure under RTI, without the earlier public-interest test.Train CPIOs on the new wording; the amendment is being challenged before the Supreme Court, so watch for changes.SFLC.in summary
Public Records Act, 1993 and Public Records Rules, 1997Central government records may be destroyed only under approved record retention schedules.Erasure of personal data in files follows these schedules, since Section 17(4) lifts DPDP erasure for the State.National Archives of India
Aadhaar Act, 2016Section 7 allows Aadhaar for subsidies and benefits. Section 29 limits sharing of Aadhaar numbers and core biometric information. UIDAI asks entities storing Aadhaar numbers to keep them in an Aadhaar Data Vault.Scheme systems should store Aadhaar numbers only in a vault and show them masked.UIDAI
CERT-In Directions, 2022 and IT Act Section 70Report cyber incidents within six hours; keep ICT logs 180 days in India. Systems declared as protected systems under Section 70 come under NCIIPC.Ministries and their portals follow these in addition to DPDP.CERT-In
MeitY Email Policy and IT resources policy for GovernmentOfficial communication should use government email and approved resources.Personal email and chat apps for files with citizen data break both these policies and DPDP safeguards.MeitY
Guidelines for Indian Government Websites (GIGW)Government websites must carry standard policies, including a privacy policy.Update website privacy policies to DPDP notice standards with the contact person.MeitY / NIC
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.
Foundation CheckFoundation-layer control assessmentDPDPiqDPDP readiness backed by evidenceCompliance FabricContinuous compliance discoveryDiEData Intelligence EngineaiQAI Investment Quotient