DPDP reference
Rule 5: Processing for subsidies, benefits, services, certificates, licences and permits
Last checked 6 Nov 2026
Processing by the State and its instrumentalities under s.7(b) follows the standards in the Second Schedule (Rule 5(1)). The standards cover lawfulness, purpose and data limits, accuracy, retention, security, intimation to the Data Principal with a contact and a link, and accountability. Rule 5(2) explains what provision under law, under policy and using public funds mean.
- Applies to
- The State and its instrumentalities.
- Starts
- 13 May 2027 (Rule 1(4)).
- Penalty
- Up to ₹50 crore (s.33, Schedule item 7).
- Source
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 5; G.S.R. 892(E), corrigenda
Questions
Which standards apply to government benefit schemes?
Those in the Second Schedule, including purpose limits, accuracy, security and intimation to the Data Principal (Rule 5(1)).
Related
- Section 7: Certain legitimate uses
- Rule 16: Exemption from Act for research, archiving or statistical purposes
- Rule 6: Reasonable security safeguards
Next
Not legal advice.