DPDP reference
Rule 23: Calling for information from Data Fiduciary or intermediary
Last checked 6 Nov 2026
For the purposes in the Seventh Schedule, the Government, through the authorised person named there, may require a Data Fiduciary or intermediary to give information within the period in its order (Rule 23(1), as corrected by G.S.R. 892(E)). The purposes are sovereignty and security, State functions and legal disclosures, and assessments for naming a Significant Data Fiduciary.
Where disclosure would harm sovereignty, integrity or security, the Government may require that the affected Data Principal and others are not told, except with written permission of the authorised person (Rule 23(2)).
- Applies to
- Every Data Fiduciary and intermediary.
- Starts
- 13 May 2027 (Rule 1(4)).
- Penalty
- Up to ₹50 crore (s.33, Schedule item 7).
- Source
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 23; G.S.R. 892(E), corrigenda
Questions
Can a business tell a person about a Government information request?
Not where the Government requires silence under Rule 23(2), except with the authorised person's written permission.
Related
- Section 36: Power to call for information
- Rule 8: Time period for specified purpose to be deemed as no longer being served
- Section 10: Additional obligations of Significant Data Fiduciary
Next
Not legal advice.