How to Respond to a Central Government Demand for Information Under Rule 23 of the DPDP Rules 2025
Most of the Digital Personal Data Protection Rules, 2025 point at the data principal. Rule 23 points the other way. It authorises a Central Government demand for information addressed to a data fiduciary or an intermediary, for purposes set out in the Seventh Schedule, and in defined circumstances it lets the government forbid the recipient from telling anyone that the demand was answered. A compliance programme built only around consent and rights requests has nothing in it for the day that letter arrives.
Step 1: Fix the Commencement Position
Rule 23 sits in the eighteen month group. Under rule 1 of the Rules, rules 3, 5 to 16, 22 and 23 come into force eighteen months after the date of publication in the Official Gazette, and the Rules were notified by G.S.R. 846(E) dated November 13, 2025, so the operative date falls in May 2027.
That makes this a design question rather than a live obligation, which is the right time to settle it. The response to a demand of this kind is governed by an internal protocol written in advance or it is governed by whoever happens to open the envelope.
Step 2: Identify the Purpose, Because the Power Is Purpose Bound
Rule 23(1) provides that the Central Government may, for such purposes of the Act as are specified in the Seventh Schedule, acting through the corresponding authorised person specified in that Schedule, require any data fiduciary or intermediary to furnish such information as may be called for, within the period specified in the requirement.
The power is therefore not general. It is exercisable for a purpose named in the Schedule and through the person the Schedule matches to that purpose. The first question on receipt is which row of the Schedule the demand is said to fall in, and the answer should appear on the face of the communication rather than be inferred.
Step 3: Work Through the Three Rows of the Seventh Schedule
The Schedule pairs each purpose with an authorised person. The first is the use by the State or its instrumentalities of a data principal's personal data in the interest of the sovereignty and integrity of India or the security of the State, where the authorised person is an officer of the State or that instrumentality designated by the Central Government or by the head of the instrumentality.
The second is the use by the State or its instrumentalities of personal data to perform a function under a law in force in India, or to disclose information to fulfil an obligation under such a law, where the authorised person is a person authorised under the applicable law. The third is carrying out an assessment of whether to notify a data fiduciary or a class of data fiduciaries as a Significant Data Fiduciary, where the authorised person is an officer of the Central Government in the Ministry of Electronics and Information Technology designated by the Secretary in charge of that Ministry.
Step 4: Check Whether the Sender Is the Authorised Person for That Purpose
Because the Schedule matches a purpose to a person, the identity of the signatory is part of the validity of the demand and not a formality. A demand about a Significant Data Fiduciary assessment comes from a designated officer of the Ministry; a demand resting on a function under another law comes from a person authorised under that law.
Record the check rather than performing it silently. Note the purpose asserted, the row it corresponds to, the designation of the signatory and the basis on which that person is the authorised person. Where the fit is not apparent, the correspondence that seeks clarification is itself the compliance step.
Step 5: Diarise the Period Specified in the Demand
Rule 23(1) ties the obligation to the period specified in the requirement, so the clock is set by the demand and not by the Rules. There is no standard period to fall back on and no built in extension, which means a request for more time is a request and should be made early and in writing.
Plan the collection work against that period. Information held across several systems, or with a processor, takes longer to assemble than the period is likely to allow, so the protocol should name the people who can pull each category and the processor contract should already oblige the processor to assist.
Step 6: Handle the Non-Disclosure Direction as a Separate Instruction
Rule 23(2) provides that where the disclosure of the furnishing of information is likely to prejudicially affect the sovereignty and integrity of India or the security of the State, the Central Government may require the data fiduciary or intermediary not to disclose that furnishing to the affected data principal or to any other person, except with the previous permission in writing of the authorised person.
Two consequences follow. A direction under this sub-rule overrides the instinct to notify the individual concerned, so the protocol has to be capable of suppressing a routine notification without the suppression itself becoming visible. And the exception is previous permission in writing, which means any later disclosure, including to a court or an auditor, needs that permission first and the file should show it was sought.
Step 7: Read the Intermediary Limb Carefully
Rule 23(3) provides that for the purposes of the rule, the expression intermediary has the same meaning as assigned to it in the Information Technology Act, 2000. The rule therefore reaches beyond data fiduciaries to a population defined by a different statute, which is unusual in this framework.
For a client that is both a data fiduciary and an intermediary, that is not an academic point. It means a single demand can engage obligations in each capacity, and the protocol should be written for the entity rather than for one role it happens to occupy.
Common Pitfalls to Avoid
Treating the power as general: Rule 23(1) is exercisable only for a purpose specified in the Seventh Schedule and through the authorised person matched to it.
Ignoring who signed: The Schedule pairs each purpose with an authorised person, so the signatory's designation goes to the validity of the demand.
Waiting for a statutory period: The period is the one specified in the demand itself.
Notifying the data principal reflexively: A direction under rule 23(2) bars disclosure of the furnishing to the affected data principal or anyone else.
Reading the exception loosely: Disclosure is permitted only with the previous permission in writing of the authorised person.
Forgetting the intermediary definition: Rule 23(3) imports the meaning of intermediary from the Information Technology Act, 2000, so the rule reaches entities defined by another statute.
Leaving the processor out of the protocol: Information held by a processor still has to be furnished within the specified period, which the processor contract has to support.
Key Statutory Provisions
Rule 23 of the Digital Personal Data Protection Rules, 2025: The Central Government may, for purposes specified in the Seventh Schedule and acting through the corresponding authorised person, require a data fiduciary or intermediary to furnish information within the period specified; where disclosure would be likely to prejudicially affect the sovereignty and integrity of India or the security of the State it may require that the furnishing not be disclosed to the affected data principal or any other person except with the previous permission in writing of the authorised person; and intermediary carries its meaning from the Information Technology Act, 2000.
The Seventh Schedule to the Rules: Three purposes with their authorised persons, being use by the State or its instrumentalities in the interest of the sovereignty and integrity of India or the security of the State, use to perform a function under a law in force or to disclose information to fulfil an obligation under such a law, and the assessment of whether to notify a Significant Data Fiduciary.
Sources and References
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments