top of page
Search

How to Process Personal Data for a State Subsidy or Benefit Under Rule 5 of the DPDP Rules 2025

Writer: Kaustav Chowdhury
Kaustav Chowdhury
Oct 12
6 min read

Updated: 17 hours ago

Processing personal data to deliver a State subsidy or benefit does not run on consent. Section 7(b) of the Digital Personal Data Protection Act, 2023 makes it a legitimate use in its own right, and rule 5 of the Digital Personal Data Protection Rules, 2025 subjects it to the standards in the Second Schedule. The work is therefore not about building a consent flow but about proving that the programme sits inside the provision and meets the standards.

Step 1: Note What Commences and When

Section 7 and rule 5 both sit in the eighteen month tranche. Under the commencement notification G.S.R. 843(E) dated November 13, 2025, sections 7 to 17 come into force eighteen months after publication, and rule 5 is in the matching group under the Rules notified by G.S.R. 846(E) of the same date, so the operative date falls in May 2027.

That is the right time to be designing, because the Second Schedule standards are governance commitments rather than switches. A delivery programme that cannot evidence them from the start will be relying on a provision whose condition it does not meet.

Step 2: Confirm the Use Is Within Section 7(b)

Section 7(b) permits processing for the State and any of its instrumentalities to provide or issue to the data principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed. Two gateways follow, and the programme has to sit in one of them.

The first is that she has previously consented to the processing of her personal data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit. The second is that the personal data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document maintained by the State or any of its instrumentalities and notified by the Central Government. Both are subject to standards for processing being in accordance with the policy issued by the Central Government or any law in force for the governance of personal data.

Step 3: Identify Which Limb of Rule 5(2) the Programme Sits In

Rule 5(2) construes the reference to a subsidy, benefit, service, certificate, licence or permit in three ways, and the characterisation should be settled on the file rather than assumed.

Provided under law means provided or issued in exercise of any power of, or the performance of any function by, the State or any of its instrumentalities under any law in force. Provided under policy means provided or issued under any policy or instruction issued by the Central Government or a State Government in exercise of its executive power. Provided using public funds means provided or issued by incurring expenditure from, or with accrual of receipts to, the Consolidated Fund or the public account of India or of the State, or in the case of a local or other authority, the funds of that authority.

Step 4: Record the Notified Database If You Rely on the Second Gateway

The second gateway in section 7(b) depends on the database, register, book or other document being maintained by the State or an instrumentality and notified by the Central Government. The notification is the load bearing element, and it is the thing most likely to be missing from a file.

So name the source, name the notification that covers it, and record the date on which it was checked. Where a programme draws on several sources, do that source by source, because the gateway is satisfied in respect of the data that comes from a notified source and not in respect of the rest.

Step 5: Apply the Second Schedule Standards

Rule 5(1) provides that processing under the rule shall be done following the standards specified in the Second Schedule. The Schedule opens by requiring appropriate technical and organisational measures to ensure effective observance of the standards that follow, which are that the processing is lawful; that it is for the permitted purpose; that it is limited to the personal data necessary for that purpose; that reasonable efforts are made to ensure the accuracy of the personal data; that the personal data is retained only for as long as required for the purpose or for compliance with law; that reasonable security safeguards are taken to prevent a personal data breach, including where a data processor is engaged; that an intimation is given to the data principal; and that accountability rests with the person who determines the purpose and means of the processing.

Read against the consent regime, this is the point worth making to a department: the absence of consent does not mean the absence of discipline. Minimisation, accuracy, retention limits and security all apply, and they apply to the processor as well.

Step 6: Build the Intimation, Because Here It Does Apply

The Schedule's intimation standard is expressed to apply where the processing is for the uses in section 7(b), so unlike the research and statistical purposes that share the same Schedule, a State delivery programme has to give the data principal an intimation.

It carries the business contact information of a person able to answer her questions about the processing, the communication link to the website or app and the other means by which she may exercise her rights under the Act, and compliance with any other applicable standards under Central Government policy or other law. Build it as an artefact that issues with the benefit, rather than as a page somewhere on a portal.

Step 7: Make the Accountability Concrete

The final standard places accountability on the person who, alone or in conjunction with other persons, determines the purpose and means of the processing. In a delivery programme that is a department or an authority rather than the vendor operating the system, and the record should say which.

Name the accountable office, not a job family, and record where the determination of purpose and means actually sits. Programmes delivered through an implementing agency are where this goes wrong, because the agency often writes the rules in practice while the department is the one answerable for the standards.

Common Pitfalls to Avoid

  • Building a consent flow anyway: Section 7(b) is a legitimate use. Consent appears only as one of the two gateways, and treating it as the basis misstates the provision.

  • Skipping the notification of the source: The second gateway depends on the database, register, book or document being notified by the Central Government, source by source.

  • Leaving the limb unidentified: Rule 5(2) distinguishes provision under law, under policy and using public funds, and the characterisation belongs on the file.

  • Reading the Schedule as lighter than the Act: Lawfulness, purpose limitation, minimisation, accuracy, retention limits, security and accountability all apply.

  • Omitting the intimation: The Schedule's intimation standard is expressed for the section 7(b) uses, so it bites here even though it does not bite for research purposes.

  • Letting the vendor carry accountability: The standard fixes it on whoever determines the purpose and means, which is normally the department rather than the implementing agency.

  • Treating the provision as presently available: Section 7 and rule 5 commence with the eighteen month tranche.

Key Statutory Provisions

  • Section 7 of the Digital Personal Data Protection Act, 2023: Clause (b) permits processing for the State and its instrumentalities to provide or issue a prescribed subsidy, benefit, service, certificate, licence or permit, either where the data principal has previously consented to such processing by the State or where the personal data is available in, or digitised from, a database, register, book or other document maintained by the State and notified by the Central Government, subject to standards in accordance with Central Government policy or law.

  • Rule 5 of the Digital Personal Data Protection Rules, 2025: Processing under the rule follows the standards in the Second Schedule, and the reference to a subsidy, benefit, service, certificate, licence or permit provided or issued is construed as provision under law, under policy, or using public funds.

  • The Second Schedule to the Rules: Appropriate technical and organisational measures to ensure observance of lawfulness, the permitted purpose, limitation to the personal data necessary, accuracy, retention only while required, reasonable security safeguards including where a processor is engaged, intimation to the data principal, and accountability of the person determining the purpose and means of processing.

Related in This Series

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page