Rule 5, processing by the State
In short
Where the State or one of its instrumentalities processes personal data for the provision or issue of a subsidy, benefit, service, certificate, licence or permit, that processing must follow the standards specified in the Second Schedule. Rule 5 also defines what the phrases under law, under policy and using public funds mean for this purpose.
01The three constructions in Rule 5(2)
| Phrase | Construction |
|---|---|
| Under law | Provision or issuance in exercise of any power of, or performance of any function by, the State or any of its instrumentalities under any law in force |
| Under policy | Provision or issuance under any policy or instruction issued by the Central Government or a State Government in exercise of its executive power |
| Using public funds | Provision or issuance by incurring expenditure from, or with accrual of receipts to, the Consolidated Fund or public account of India or of a State, or the funds of a local or other authority within India or under the control of the Government of India or of any State |
02What the Second Schedule standards require
The Second Schedule requires implementation of appropriate technical and organisational measures to ensure that processing is lawful; is done for the uses in Section 7(b) of the Act or the purposes in Section 17(2)(b) as the case may be; is limited to the personal data necessary; is done with reasonable efforts towards completeness, accuracy and consistency; is retained only as long as required or as another law requires; is protected by reasonable security safeguards, including where processing is carried out on behalf of the Data Fiduciary by a Data Processor; is accompanied, where done under Section 7(b), by an intimation to the Data Principal together with contact information and the means of exercising rights; and is accountable to the person who determines the purpose and means of the processing.
The same Second Schedule standards are applied by Rule 16 to processing necessary for research, archiving or statistical purposes.
03Common questions
Does Rule 5 apply to private companies?
Rule 5 governs processing by the State and its instrumentalities for the specified purposes. Rule 16 applies the same Second Schedule standards to research, archiving and statistical processing.
Where are the standards set out?
In the Second Schedule to the Rules, which Rule 5(1) applies.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.