Rule 5: Processing of Personal Data by State and Its Instrumentalities

Quick summary

What Rule 5 says

• Processing personal data under this rule must follow the standards specified in the Second Schedule.
• “Under law” covers provision or issuance of a subsidy, benefit, service, certificate, licence or permit in exercise of a legal power or function.
• “Under policy” covers the same, but issued under a Central or State Government policy or executive instruction rather than a specific law.
• “Using public funds” covers the same, where expenditure comes from the Consolidated Fund of India, a State's Consolidated Fund, public accounts, or the funds of a local or other authority.

Breaking it down

This rule exists because a huge share of personal-data processing in India happens through government welfare and services delivery, not private businesses, and it needs its own standard rather than being folded into the general rules aimed at Data Fiduciaries.

Three routes, one standard. Whether a scheme operates under a specific law, under a government policy without a dedicated law, or simply because it's funded from public money, Rule 5 applies the same Second Schedule standard across all three — closing a gap where processing might otherwise escape scrutiny just because it wasn't authorised by a named statute.

The Second Schedule standard itself is broad but concrete. It requires lawful processing; that processing be limited to the specified subsidy/benefit/service purpose; data minimisation (collecting only what's necessary); reasonable efforts toward accuracy and consistency; retention only as long as needed; reasonable security safeguards; and, notably, giving the individual an intimation containing contact details and the communication link for exercising her rights — the same notice-style transparency expected of private Data Fiduciaries.

Why this rule matters

Government data systems — ration card databases, scholarship portals, pension disbursement systems — handle some of the most sensitive and large-scale personal data processing in the country. Rule 5 makes clear this isn't exempt from data-protection standards just because it's the State doing the processing.

Real-world example

Who needs to care about this rule

• Government departments and public-sector bodies running welfare, licensing or benefits programmes.
• Vendors and system integrators building government portals and databases on the State's behalf.

Common questions

Related rules