Do we need citizens' consent to run a scheme?

Short answer: Usually not; Section 7(b) or 7(c) with Rule 5 standards

Usually not. Section 7(b) allows the State to process personal data to give a subsidy, benefit, service, certificate, licence or permit, and Section 7(c) covers functions under law. Rule 5 then asks that this processing meet the Second Schedule standards. Consent is still needed for uses outside these, such as publicity stories or surveys not tied to the scheme.

What the law says

Section 7(b) and 7(c) set the bases. Rule 5 and the Second Schedule set the standards.

Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
Section 4: Personal data may be processed only for a lawful purpose, either with the person's consent or for one of the legitimate uses listed in Section 7.

Steps

Write the basis for each scheme: 7(b), 7(c) or consent.
Check each scheme against the Second Schedule standards.
Remove fields not needed for the benefit.
Publish a contact for questions and rights.
Take consent for extra uses.

Evidence to keep

Basis register
Standards check
Published contact

Common mistakes

Taking 'consent' that citizens cannot refuse
Collecting extra fields 'for analysis'
No contact for questions

From each seat

Data protection nodal officer: Own the basis register.
Secretary / Head of Department: Approve the register at your level.
Legal cell: Write the basis with the scheme's own law or guidelines.
Scheme or programme head: Your scheme guidelines decide the fields; review them.

What a good answer from management sounds like

“Each scheme has a written basis and a standards check, and every portal shows a contact.” Effort and time: Medium · 6 to 10 weeks.