Rule 23, calling for information
In short
The Central Government may, for the purposes of the Act specified in the Seventh Schedule and acting through the corresponding authorised person specified in that Schedule, require a Data Fiduciary or intermediary to furnish information within the period specified in the requirement.
Where disclosure of the furnishing is likely to prejudicially affect the sovereignty and integrity of India or the security of the State, the Government may require the Data Fiduciary or intermediary not to disclose that furnishing to the affected Data Principal or to any other person, except with the previous written permission of the authorised person.
01The Seventh Schedule purposes
| Purpose | Authorised person |
|---|---|
| Use, by the State or its instrumentalities, of personal data in the interest of the sovereignty and integrity of India or the security of the State | An officer of the State or of the instrumentality notified under Section 17(2)(a) of the Act, designated by the Central Government or the head of the instrumentality |
| Use, by the State or its instrumentalities, of personal data for the performance of a function under any law in force in India, or disclosure of information to fulfil an obligation under any law in force in India | The person authorised under applicable law |
| Carrying out an assessment for notifying a Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary | An officer of the Central Government in the Ministry of Electronics and Information Technology designated by the Secretary in charge of that Ministry |
The third purpose is the one most organisations will encounter. It is the mechanism by which the assessment underlying a Significant Data Fiduciary designation is carried out.
02The link to Rule 8
The Seventh Schedule is referred to both by Rule 23(1) and by Rule 8(3). The one year minimum retention of personal data, associated traffic data and logs under Rule 8(3) is expressed to be for the purposes specified in the Seventh Schedule.
Intermediary in Rule 23 carries the meaning assigned to it in the Information Technology Act, 2000.
03Common questions
Who can call for information?
The Central Government, acting through the authorised person corresponding to the purpose specified in the Seventh Schedule.
Can a Data Fiduciary be required not to disclose the request?
Yes, where disclosure is likely to prejudicially affect the sovereignty and integrity of India or the security of the State, under Rule 23(2).
How does this connect to Significant Data Fiduciary designation?
The Seventh Schedule lists carrying out an assessment for notifying a Data Fiduciary or class of Data Fiduciaries as a Significant Data Fiduciary as one of the purposes.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.