State
The Government and its instrumentalities, as the term is used in Article 12 of the Constitution.
"State" means the Government and the bodies it controls, in the sense used in Article 12 of the Constitution. The DPDP Act gives it some special treatment, but it is still covered by the Act.
Meaning of State
The State has special treatment in the Act. It can process data for subsidies and benefits, and certain notified State instrumentalities can be exempted in the interest of sovereignty, security and public order. Processing by the State must still meet the standards in the Second Schedule.
The Act does not invent its own list for "State". Section 2 says it has the same meaning as in Article 12 of the Constitution, which covers the Government and Parliament of India, the Government and legislature of each State, and all local and other authorities within the territory of India or under the control of the Government of India. Courts have read "other authorities" to include bodies that are instruments of government, so a public-sector undertaking or a statutory corporation can fall within it, while a purely private company usually does not.
Why the label matters is found in several sections. Section 7(b) and (c) allow the State and its instrumentalities to process personal data without consent for subsidies, benefits, services, licences and permits, and for functions under law or for sovereignty and security. Section 7(d) covers disclosure to the State where a law requires it. Section 17(2) allows the Central Government to exempt notified instrumentalities in the interest of sovereignty, security, public order and similar grounds, and Rule 5 with the Second Schedule sets standards for State processing.
These permissions are not a free pass. A State body processing data for a benefit scheme must still observe reasonable security safeguards under Section 8(5), erase data when it is no longer needed under Section 8(7) unless a law requires retention, and publish a contact for questions. The exemption under Section 17(2) is not automatic; it requires a notification by the Central Government, and it works for the instrumentality and purposes named in it.
It helps to separate three ideas. The State as a Data Fiduciary is the government entity that decides processing. The State as a recipient is the authority to which a private company must disclose data under a law. The State as a regulator is the Board and the Central Government exercising powers under the Act. A private bank asked for data by a tax authority is not the State, but the authority is, and the bank's disclosure is a Section 7(d) matter.
Examples of State
A government department processing personal data to deliver a welfare benefit is acting as the State.
A state department runs a pension scheme and collects Aadhaar-linked bank details from retirees. It processes this under Section 7(b) without separate consent, but it still protects the database with access controls and publishes a contact for retirees' questions.
A software company builds and hosts a licensing portal for a transport authority. The authority is the State and the Data Fiduciary, while the vendor is a processor bound by contract to follow instructions, apply Rule 6 safeguards and report any breach to the authority.
A private bank receives a written demand from an income-tax authority for account details under a statute. The bank itself is not the State, but its disclosure to the authority is covered by Section 7(d), provided it shares only what the law requires.
Why State matters
For citizens, the State is often the largest holder of personal data, from ration cards and land records to health IDs and pension systems. Knowing that the State is covered, with specific carve-outs, explains why a department can sometimes process data without asking you for consent yet must still protect it and answer your requests.
For businesses that work with government, the term decides which rules apply. A vendor running a portal for a state department may be a processor for a State fiduciary, and its contracts must reflect Rule 5 standards and the department's own security requirements. Contractors often assume that public-sector work lifts their obligations, which is not safe to assume without checking the exemption actually notified.
How it works in practice
- 1If you are a government body, map each processing activity to a legal basis: consent, Section 7(b), 7(c), 7(d), or another clause. Record which law or scheme authorises the processing, because the justification should be demonstrable.
- 2Apply the Second Schedule standards through Rule 5 to State processing. Read the Schedule itself and build its standards into scheme guidelines and portal design.
- 3If you are a private vendor to the State, confirm in writing whether the department is the Data Fiduciary and you are its Data Processor, and align your contract with Section 8(2) and the Rule 6 safeguards.
- 4When you receive a demand for data from a government authority, ask for the legal provision under which it is made, log the request, and disclose only what the provision requires.
- 5Watch for Central Government notifications under Section 17(2), since any exemption applies only to the instrumentalities and purposes it names.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming every government-linked entity is automatically exempt. Exemption under Section 17(2) needs a Central Government notification naming the body and purposes.
Treating Section 7 legitimate uses as a licence to over-collect. The State may skip consent for named purposes, but it must still limit data to what the purpose needs.
Believing a private company doing government work becomes the State. A contractor is usually a processor or an independent fiduciary, not an instrumentality of the State.
Forgetting that State bodies have Data Principal-facing duties. Citizens can still raise grievances and approach the Board about State processing.
Compliance tips
Document the statutory basis for each government dataset in a register, including the Act, scheme order or notification relied on.
Put Rule 5 and Second Schedule checks into project approvals for any new citizen-facing digital service.
When a department outsources, issue processor contracts that name security controls, breach-reporting timelines and erasure steps rather than relying on general tender terms.
Train front-line officials on how to respond to access and correction requests, because these are often the first point where the Act shows up in public service delivery.
Common questions about State
Does the DPDP Act apply to government departments?
Yes. The State is a "person" and can be a Data Fiduciary. It has special grounds such as Section 7(b) and 7(c) and possible exemptions under Section 17(2), but these are specific and conditional, not a general exclusion from the Act.
What does State mean in the DPDP Act?
It has the meaning given in Article 12 of the Constitution: Union and State governments, legislatures, and local or other authorities under their control. Whether a particular public body qualifies can depend on how it is set up and controlled.
Can the government process my data without my consent?
Only in the cases the Act lists, such as providing a subsidy, benefit, licence or permit, performing a legal function, or meeting a legal disclosure duty. Outside those cases, consent is generally needed. Even then, the body must protect the data and honour your rights.
Is a public sector bank the State?
It may depend on how the body is constituted and controlled; Article 12 has been interpreted by courts case by case. For compliance, assume that duties of a Data Fiduciary apply to it and check separately whether any State-specific ground or exemption is available.