DPDP Insights › Questions › Police, a court or a regulator asks for someone's data. What

Question

Police, a court or a regulator asks for someone's data. What do we do?

Short answer: Yes, when the request is lawful and in writing

Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.

What the law says

Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences.

Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.

Steps

Route every such request to Legal.
Check the authority, the legal power and the scope.
Share only what is asked, by a secure method.
Log the request, what was sent, by whom and when.
Tell the person, unless the law or the authority says you must not.

Evidence to keep

Authority request log
Copies of requests
Record of what was sent

Common mistakes

Sharing on a phone call
Sending whole files when a few lines were asked
No log

How it plays out by sector

Banking, financial services and insurance: Banks receive many police and tax requests. Route them all through one desk.
Central government: ministries and departments: Requests from other agencies need a written basis and a log.
Public sector undertakings and utilities: Police and agencies ask for consumer details; log each request.
Healthcare and hospitals: Police requests for MLC records and court summons are common.

From each seat

Legal & compliance: Own the authority request log. Check the legal power every time, even for familiar requesters.
Legal department: Check the legal power for every request and log what was shared.

What a good answer from management sounds like

“All authority requests go through Legal. We check the power, share only what is needed, and keep a log.” Effort and time: Light · 2 to 3 weeks.