Rule 23: Calling for Information From Data Fiduciary or Intermediary
Rule 23 is the final rule in the set, and it's a government information-demand power — who can require what information from a Data Fiduciary or intermediary, and when that disclosure can be kept from the affected individual.
Quick summary
What Rule 23 says
- For purposes of the Act specified in the Seventh Schedule, the Central Government — acting through the authorised person the Schedule names for that purpose — may require a Data Fiduciary or intermediary to furnish specified information, within a specified period.
- Where disclosure of that information-furnishing would prejudicially affect India's sovereignty and integrity or the security of the State, the government can require the Data Fiduciary or intermediary not to disclose it to the affected Data Principal or anyone else, except with the authorised person's prior written permission.
- “Intermediary” takes the meaning assigned to it under the Information Technology Act, 2000.
Breaking it down
Two provisions, each with a specific purpose:
The Seventh Schedule defines who can ask, and why. This isn't an open-ended power for any government official to demand information for any reason. The Seventh Schedule specifically names three purposes — sovereignty/ security-related use of personal data by the State, other lawful-purpose use or disclosure by the State, and assessment for notifying a Significant Data Fiduciary — and names the specific authorised person for each (an officer the Central Government designates, a person authorised under applicable law, or a MeitY-designated officer, respectively).
The confidentiality direction is a real, if narrow, exception to transparency. Ordinarily, a Data Principal would expect to know when her data or information about her has been the subject of a government information request. Rule 23 allows the government to override that expectation specifically where disclosure would prejudicially affect India's sovereignty, integrity or security — and even then, disclosure isn't permanently barred, just conditioned on the authorised person's prior written permission.
This closes out the Rules with an enforcement/oversight tool. Fittingly, the final rule in the sequence gives the government (through the Board and the authorised persons named in the Seventh Schedule) the information-gathering power needed to actually assess compliance and, where relevant, notify Significant Data Fiduciaries — tying back to Rule 13.
Why this rule matters
If your organisation ever receives an information request citing Rule 23, understanding which purpose and which authorised person it falls under (per the Seventh Schedule) is the first step to responding appropriately — and understanding that a related non-disclosure direction, if issued, is a specific, security-justified exception rather than a routine instruction.
Real-world example
Who needs to care about this rule
- Data Fiduciaries and intermediaries that may receive a government information request under this Rule.
- Legal teams verifying that a request comes from the correctly authorised person for its stated purpose under the Seventh Schedule.
Common questions
Can any government official demand information under Rule 23?
If I receive a Rule 23 request, must I tell the affected Data Principal?
How does this rule connect to Significant Data Fiduciary status?
Related rules
Rule 22 — Appeal to Appellate Tribunal
Read the previous rule in sequence.
Read Rule 22Full DPDP Rules Guide
Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.
View all 23 rulesSchedules at a Glance
All seven Schedules referenced across the Rules, including the Seventh Schedule's authorised-person table.
See the Schedules