For Public Bodies

Government: services, suppliers and citizen data

A few items on this page are marked Confirmation pending. What’s pending

A public service is not a blanket waiver. Name the ground and protect the records.

Last updated: 1 November 2026Written and edited by Sandesh Kokate

Checked against primary sources where marked. Items marked Confirmation pending are not yet checked. See the list

Dates that matter

13 November 2026: Consent Manager registration — only if you are building one (s.6(9); Rule 4).
13 May 2027: Main duties — planning target (Rule 1(4)).

Confirmation pending: later changes to these dates, and Board appointments. Recruitment is not appointment. Check status

Personal data: Information about a person you can identify from it or in relation to it. LAW · s.2(t) · Act p.3
Data Principal: The person the data is about. For a child, this includes parents or a lawful guardian. For a person with disability, it includes her lawful guardian acting for her where she has one. LAW · s.2(j) · Act p.2
Data Fiduciary: The person or body that decides why and how personal data is used. The boss. LAW · s.2(i), (s) · Act pp.2–3
Data Processor: The person who handles personal data on behalf of the boss. The helper. LAW · s.2(k) · Act p.2
Personal data breach: Unauthorised use, or an accident involving data, that harms its secrecy, accuracy or availability. LAW · s.2(u) · Act p.3
Consent Manager: A person registered with the Board who lets people give, manage, review and withdraw consent in one place. LAW · s.2(g) · Act p.2
Data Protection Board: The Data Protection Board of India, established under section 18. LAW · s.2(c); s.18 · Act p.2

1. Benefit application
LAW
s.7(b) · Act p.6 Rule 5 · Rules p.25
Step 1 of the basics
- Good practice: Check prior consent or the notified record conditions.
GOOD PRACTICE Proof: The scheme ground and eligibility note.
Read the clause guide →
2. Statutory function
LAW
s.7(c) · Act p.7
- Good practice: Name the law and public function behind the use.
GOOD PRACTICE Proof: The department legal-purpose record.
3. Disaster assistance
LAW
s.7(h) · Act p.7
- Good practice: Keep crisis use within the disaster or public-order purpose.
GOOD PRACTICE Proof: The disaster-response purpose log.
4. Department supplier
LAW
s.8(1), (2) · Act p.7
Step 4 of the basics
- Good practice: Write supplier tasks and access limits into the contract.
GOOD PRACTICE Proof: The public supplier data terms.
Read the clause guide →
5. Resident data breach
LAW
s.8(6) · Act p.7 Rule 7 · Rules p.26
Step 5 of the basics
- Good practice: Plan both citizen alerts and Board reports.
GOOD PRACTICE Proof: The departmental breach drill.
Read the clause guide →
6. Public scheme records
LAW
Rule 5 · Rules p.25 Second Schedule · Rules p.34
- Good practice: Apply the Second Schedule to covered scheme processing.
GOOD PRACTICE Proof: The scheme safeguards review.
Read the clause guide →