Call for Information
The Government’s power to require the Board, a fiduciary or an intermediary to supply information.
The Central Government can require the Board, a Data Fiduciary or an intermediary to hand over information it needs to administer the Act. Rule 23 spells out how that works.
Meaning of Call for Information
Section 36 allows the Central Government to call for information it needs for the purposes of the Act. The Rules add procedures for how such calls are made.
Section 36 is brief: for the purposes of the Act, the Central Government may require the Board, and any Data Fiduciary or intermediary, to furnish such information as it may call for. It stands apart from the Board's own inquiry powers in Sections 27 and 28, which are tied to a specific complaint or breach. Section 36 belongs to the Government directly and does not need a pending case; it supports oversight of how the law is working across the economy.
The Rules supply the detail. Rule 23 says that, for the purposes set out in the Seventh Schedule, the Central Government may require a Data Fiduciary or intermediary to furnish specified information within a specified period, acting through the authorised person named in that Schedule for each purpose. The Schedule lists three purposes: use of personal data by the State in the interest of sovereignty, integrity and security; other lawful use or disclosure by the State; and assessing whether a fiduciary or class of fiduciaries should be notified as a Significant Data Fiduciary. A different authorised person is named for each.
Rule 23 also contains a confidentiality power. Where disclosure of the request would prejudicially affect India's sovereignty and integrity or the security of the State, the Government can require the recipient not to disclose that it has furnished the information, to the Data Principal or to anyone else, except with the authorised person's prior written permission. This is a narrow carve-out from the usual expectation of transparency, not a routine instruction attached to every request.
Section 36 should be read with the rest of the Act's structure. It does not turn the Government into an investigator of individual complaints, which is the Board's role. It does not remove your obligations to protect the data you hand over, either. An organisation that responds should still apply purpose limitation and security safeguards to the material it sends, and should send what is asked for rather than a full database export. The same applies to an intermediary, which the IT Act defines broadly as a service that receives, stores or transmits records on behalf of others.
Examples of Call for Information
The Government asks a Data Fiduciary for details of how it handled a set of user records.
A large marketplace receives a letter from a MeitY-designated officer citing Rule 23 and the Significant Data Fiduciary assessment purpose. The legal team confirms the officer's authority, sends transaction-volume and data-category summaries rather than customer lists, and replies within the stated period.
A hosting company is asked to furnish details about the records a client stores on its servers. The company checks the Seventh Schedule purpose, tells the client where the law permits, and, where a confidentiality direction applies, supplies only what is required and holds back from informing the client until permitted.
A start-up receives a request for information on how many patient accounts it holds and what safeguards protect them. It prepares a short compliance statement and attaches its latest security audit summary, without sharing individual patient files.
Why Call for Information matters
A call for information is how the Government gathers the facts it needs to do things like deciding which organisations should be treated as Significant Data Fiduciaries, a status that brings annual audits, impact assessments and algorithmic due diligence, with a penalty ceiling of ₹150 crore for failing the additional duties. A careless or late reply can leave the Government with an incomplete picture, or can create a record of non-cooperation.
For a Data Principal, the provision matters because the confidentiality direction means you may never be told that information about you was requested. That is why the Rule limits the direction to security-related grounds and requires prior written permission for any later disclosure. Organisations that receive such requests carry a real responsibility to check that the request is lawful and proportionate.
How it works in practice
- 1Set up a single intake point, usually the legal or compliance team, to receive any government information request. Instruct customer-facing and engineering staff to forward such letters at once rather than answering them informally.
- 2Verify the request. Check that it cites Section 36 and Rule 23, names the purpose in the Seventh Schedule, comes from the authorised person listed for that purpose, and gives a period for reply. If any of these are missing, ask for clarification in writing before sending data.
- 3Define the scope with the sender. Identify exactly which systems, data fields and date ranges are covered, and share only what is asked for. Where possible, send aggregated or de-identified material instead of raw personal data.
- 4Respond in the specified period through a secure channel, with a cover note listing what was provided, who prepared it and when. Keep a copy of the response and of any correspondence in a restricted file.
- 5If the request carries a non-disclosure direction, restrict knowledge of it to the smallest necessary group, record who has been told, and do not mention it in customer communications or in the privacy notice's transparency statements without written permission.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating any official letter as binding. A valid call under Rule 23 comes from the authorised person for a Seventh Schedule purpose. Verify before you disclose personal data.
Sending everything. Over-sharing can itself breach purpose limitation and security duties. Provide what is asked and no more.
Missing the reply period. The call specifies a time. Late or partial replies create avoidable regulatory friction, so ask for an extension in writing before the deadline if you need one.
Telling the affected person despite a non-disclosure direction. Where a Rule 23 direction applies, disclosure needs the authorised person's prior written permission.
Compliance tips
Add a "government requests" procedure to your incident and legal playbooks, with a named backup for holidays and weekends.
Keep a log of requests received, what was provided and by whom, so you can show your process to the Board if asked.
Maintain an up-to-date data inventory. You cannot answer a precise request quickly if you do not know where your data sits.
Review your privacy notice and contracts for statements about government disclosures, and make sure they are accurate and do not promise what the law may not allow.
Common questions about Call for Information
Who can ask for information under Section 36 of the DPDP Act?
The Central Government, for the purposes of the Act. Rule 23 says it acts through the authorised person named in the Seventh Schedule for each stated purpose. It can require information from the Board, a Data Fiduciary or an intermediary.
Do I have to tell the Data Principal if I give information to the Government?
Not if the Government has directed otherwise. Under Rule 23, where disclosure would prejudicially affect India's sovereignty and integrity or the security of the State, you must not disclose it without the authorised person's prior written permission.
Is a call for information the same as a Board inquiry?
No. A Board inquiry under Sections 27 and 28 follows a complaint or breach and can end in a penalty. A Section 36 call is a general information power exercised by the Central Government, and does not need a pending complaint.
Does Section 36 apply to intermediaries as well?
Yes. Section 36 names Data Fiduciaries and intermediaries, and Rule 23 repeats this. Intermediary has the meaning given in the IT Act, 2000, so hosting providers, network services and platforms that transmit or store data for others may receive such requests.