DPDP for Government and Public Services

Can I ask a government department to delete my data?

Generally no, and this is one place the law is deliberately weaker. For processing by the State, both the duty to delete once the purpose has ended and your right to demand deletion are switched off.

What remains is a standard the State has to observe: your data kept only as long as it is needed for that use, or for compliance with a law. So the limit exists. It is just something the State is required to observe rather than something you can demand.

ACT · Sections 17(4), 8(7) and 12(3); RULES · Second Schedule.

Can I ask them to correct wrong information about me?

Usually yes. The State's exemption from correction only bites where the processing is for a purpose that does not involve making a decision that affects you. Eligibility, entitlement and licensing decisions plainly affect you, so correction still applies there.

Where it applies, the wording leaves no discretion. They have to correct what is inaccurate or misleading, complete what is incomplete, and update it.

ACT · Sections 12(2) and 17(4).

Does a government body need my consent to process my data for a scheme?

Not necessarily. Consent is not needed again where you had already agreed to your data being used for a subsidy, benefit, service, certificate, licence or permit, or where the data already sits in a State database the Central Government has notified.

That is a reason to process, not a free hand. The standards that come with it still cap it at what is necessary, and require security, efforts at accuracy, limited retention and accountability.

ACT · Section 7(b); RULES · Rule 5 and Second Schedule.

Which parts of government are outside the Act completely?

Only a part of the State that the Central Government has specifically named, and only where the processing is in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, or preventing incitement to a serious offence connected to those. What the Central Government does with material such a body passes to it is also outside.

Everything else in government sits inside the law. A department cannot put itself outside it by saying so. It depends on an actual notification.

ACT · Section 17(2)(a).

Can the government make a company hand over my data, and will I know?

Yes, within limits. The Central Government can require the Board, a company holding your data, or an intermediary to furnish information. The request has to be for one of three listed purposes, and it has to come through the named authorised person for that purpose.

You may not be told. Where revealing the request would prejudice the sovereignty and integrity of India or the security of the State, the Government can require the company not to tell you, or anyone else, without written permission first.

ACT · Section 36; RULES · Rule 23 and Seventh Schedule.

A scheme says it will keep my data indefinitely. Is that allowed?

The standard is that it is kept only while it is needed for that use, or while a law requires it. Indefinite retention with no stated purpose and no legal requirement does not meet that.

There is also a minimum that gets misread in both directions. Personal data, related traffic data and logs have to be kept for at least a year for certain listed purposes. That is a floor, so it is not authority to keep something forever, and it is not something to be ignored by deleting early either.

RULES · Second Schedule; Rule 8(3) with the Seventh Schedule.

The department published a beneficiary list with my name and address. Is that allowed?

Publishing is a disclosure, and it needs a reason like anything else. The standards the State has to observe cap processing at what is necessary for the purpose, so a list published more widely than the purpose needs, or carrying more about you than the purpose needs, does not sit comfortably inside that.

Being the beneficiary of a scheme is not in itself a reason to be findable by anyone with a browser. If a transparency duty genuinely requires publication, that duty is what would have to carry it, and it would still be limited to what the duty actually asks for.

ACT · Section 7(b); RULES · Rule 5 and the Second Schedule.

Can I complain about how a government department handled my data?

Yes, and this is worth knowing precisely because so much else is switched off for the State. The exemption removes the duty to delete, and your right to demand deletion. It does not touch your right to complain.

So you keep a right to a workable complaints route about anything the department does or fails to do with your information, and it still has to publish contact details for somebody who can answer questions about it.

The order applies here as everywhere. Exhaust the department's own process before going to the Data Protection Board.

ACT · Sections 13(1), 13(3), 8(9) and 17(4).

The government is exempt from the data protection law, so none of this applies to us.

That is wrong as a general statement. The full exemption reaches only a body the Central Government has actually named, and only for sovereignty and integrity, the security of the State, friendly relations, public order, or preventing incitement to a serious offence connected to those. A department issuing a certificate or running a benefits scheme is an ordinary organisation under this law, and it is bound by the eight standards.

The data protection law requires your Aadhaar before we can give you this benefit.

This law imposes no such requirement and names no particular identity document. Where an Aadhaar requirement genuinely exists it comes from the Aadhaar Act and the scheme's own notification, and that is what should be quoted. This law only governs what happens to whatever is collected. It is not a mandate to collect anything.

It is a government scheme, so we can share your details with any other department or agency.

The standards limit a department to what is necessary for that use, and require it to answer for observing them. A separate disclosure needs its own footing. Being government is not itself a reason for passing your details on.

You have no rights at all against a government department.

You have fewer, not none. Where the State is the one holding your information, the duty to delete and your right to demand deletion are removed. But your right to ask what they hold, and your right to complain, both remain, and correction survives wherever what they are doing involves making a decision that affects you, which covers most benefit and eligibility decisions.

We asked the company for your data under a government power, so you will be told about it.

Not necessarily. The Central Government can require the organisation not to disclose that a request was even made, where telling you would prejudice the sovereignty and integrity of India or the security of the State. Lifting that gag needs written permission first.