The State Processes On Different Terms.
Section 7(b) lets the State provide subsidies, benefits, services, certificates, licences and permits without consent. Section 17(2)(a) can take a notified instrumentality outside the Act altogether. Neither is a blanket exemption, and the difference between them is the whole point.
Covers: central and state departments, municipal bodies, public sector undertakings, welfare schemes.
Why this sector is treated differently
Public sector processing sits under two distinct provisions that are frequently conflated, and getting them the wrong way round produces either unnecessary consent flows or unlawful processing.
Section 7 sets out certain legitimate uses - grounds on which personal data may be processed without consent. Clause (b) covers the State and its instrumentalities providing a subsidy, benefit, service, certificate, licence or permit as may be prescribed, subject to the conditions set out in the section. This is a lawful basis, not an exemption. Everything else in the Act still applies: purpose limitation, accuracy, security safeguards, breach notification, erasure and the Chapter III rights all continue to run. A citizen receiving a benefit under section 7(b) retains her right of access under section 11 and correction under section 12.
Section 17(2)(a) is a different instrument entirely. It provides that the Act shall not apply in respect of processing by such instrumentality of the State as the Central Government may notify, in the interests of the sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, and the related grounds. This is disapplication of the whole Act, and it operates by notification of a specific instrumentality. An organisation is either notified or it is not.
The Rules add operational detail. The Second Schedule, through rule 5, sets standards for State processing under section 7(b). The Seventh Schedule, through rules 23(1) and 8(3), pairs each purpose with the authorised person who may act on it - beginning with use by the State in the interest of sovereignty and integrity or security of the State, exercised by an officer designated under section 17(2)(a) - and fixes a one-year floor for retaining processing logs.
What you actually process
One row per activity, not per data type. Lawful basis and erasure attach to a purpose, so the same phone number can sit in three rows below with three different answers.
| Activity | Lawful basis | When it must go |
|---|---|---|
| Issue a subsidy or benefitIdentity, Eligibility evidence, Bank details, Household data | § 7(b)The State and its instrumentalities may process without consent to provide a subsidy, benefit, service, certificate, licence or permit as may be prescribed, subject to the conditions in the section. This is a lawful basis, not an exemption. | § 8(7)Public records law generally requires retention; those periods come from those rules, not from this Act. |
| Answer a citizen's requestWhatever the citizen asks about | § 11Processing without consent under section 7 does not disapply Chapter III. Access, correction, erasure, grievance redressal and nomination all continue to run against the department. | § 8(7)Keep what evidences the response. |
| Retain processing logsProcessing logs, Access records | rule 8(3)Rule 8(3) with the Seventh Schedule fixes a one-year minimum for retaining processing logs. | rule 8(3)One year minimum. Longer where your own records rules require it. |
| Rely on a notified exemptionWhatever the notified purpose covers | § 17(2)(a)The Act does not apply to processing by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State and the related grounds. It operates by notification of a specific body. | rule 8(3)Logging obligations still bite where the Seventh Schedule applies. |
The data flow, and where it breaks
Each lane follows one activity through the actors and systems that touch the data. The failure mode sits on the hop where it happens, rather than in a list somewhere else on the page.
Issue a subsidy or benefit
Deliver the scheme to the citizen entitled to it
- ApplicationCollects the claim§ 7(b)Fails when: Consent forms used where section 7(b) already supplies the basis, promising a withdrawal right that cannot be honoured
- Eligibility checkVerifies against other databasesSecond ScheduleFails when: The Second Schedule standards for State processing never consulted
- DisbursementPays the benefitFails when: Payment data shared more widely than the scheme requires
Answer a citizen's request
Discharge Chapter III duties, which section 7(b) does not switch off
- Published contactReceives the request§ 8(9)Fails when: No published channel, so requests go to a general grievance queue
- Identity checkConfirms the requesterFails when: Verification so heavy it becomes a barrier to the right
- Departmental sweepFinds the data across systems§ 11Fails when: Legacy and state-level systems outside the sweep
Retain processing logs
Meet the logging floor the Rules set
- SystemsEmit access and processing logsrule 8(3)Fails when: Logs rotated at thirty days, below the floor
- Log storeRetains themSeventh ScheduleFails when: Logs themselves containing personal data and never brought into the data map
Rely on a notified exemption
Process under section 17(2)(a) where the Government has notified the body
- NotificationNames the instrumentality§ 17(2)(a)Fails when: Assumed rather than held, so the department operates as if exempt when it is not
- Designated officerExercises the powerSeventh ScheduleFails when: The Seventh Schedule pairing of purpose to authorised person ignored
The provisions that apply
Subsidies, benefits, services, licences
Personal data may be processed without consent for the State and its instrumentalities to provide or issue a subsidy, benefit, service, certificate, licence or permit as may be prescribed, subject to the conditions in the section. This is a lawful basis for processing. It does not switch off notice-adjacent duties, security obligations or the Data Principal's rights.
Notified instrumentalities, outside the Act
The Act does not apply to processing by such instrumentality of the State as the Central Government may notify, in the interests of the sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order and related grounds. This is disapplication of the entire Act, by notification, to a named body - not a purpose-based exemption any department can claim.
Standards for State processing
Rule 5 with the Second Schedule sets the standards that apply where the State processes personal data under section 7(b). If your department relies on that legitimate use, this Schedule is the operational specification for how, and it is the document an audit will measure you against.
Who may demand data, and the log floor
Rules 23(1) and 8(3) with the Seventh Schedule pair each purpose with the authorised person who may act on it, beginning with use by the State in the interest of sovereignty and integrity or security of the State, exercised by an officer designated under section 17(2)(a). Rule 8(3) points here for the one-year minimum retention of processing logs.
What to do about it
Establish which provision you are actually relying on
Section 7(b) is a lawful basis with all other duties intact. Section 17(2)(a) is disapplication of the Act by notification. Departments that assume they hold the second while in fact operating under the first will have unmet rights and security obligations, and the gap is invisible until someone makes a request.
Confirm the subsidy or service is prescribed
Section 7(b) applies to a subsidy, benefit, service, certificate, licence or permit as may be prescribed, and on the conditions in the section. Check your programme against what is actually prescribed rather than assuming that all public service delivery is covered by the general shape of the clause.
Build rights handling even under section 7(b)
Processing without consent does not remove Chapter III. Access under section 11, correction and erasure under section 12, grievance redressal under section 13 and nomination under section 14 all continue. A citizen-facing request channel is required, not optional, and it has to work at the volumes public programmes generate.
Set log retention to the one-year floor
Rule 8(3) with the Seventh Schedule fixes a one-year minimum for retaining processing logs. Treat it as a floor and check it against any longer retention your own records rules impose, then implement whichever is longer.
Sequence the work
The same controls as above, in the order they are worth doing. Each names the evidence you would put in front of an auditor, because a control you cannot evidence is a control you cannot prove you had.
Build the foundation
Get the lawful basis and the roles right. Everything else assumes these are settled.
- Issue a subsidy or benefitCheck your scheme against what is actually prescribed, and apply the Second Schedule standards rather than assuming public delivery is self-justifying.Evidence: The determination that the scheme falls within section 7(b), and a mapping to the Second Schedule standards.
Operationalise it
Turn the basis into systems that run without anyone remembering to run them.
- Retain processing logsSet retention to the floor or to your own records rules, whichever is longer, and treat the logs as personal data in their own right.Evidence: Log retention configuration, and the logs inside the data map.
Keep it honest
Prove it still works, and answer the people whose data it is.
- Answer a citizen's requestStand up a citizen-facing request channel that works at the volume public programmes generate, and name every system in the sweep.Evidence: Request log with timestamps and outcomes, and the sweep list under version control.
- Rely on a notified exemptionEstablish which provision you actually rely on. Section 7(b) is a basis with every other duty intact; section 17(2)(a) is disapplication of the whole Act, by notification. Departments that confuse the two have unmet rights obligations they cannot see.Evidence: The notification itself, and the designation of the officer authorised to act on each purpose.
Section and Schedule references above point at the statute itself. Read them in context in the full text of the Act, or against the MeitY publication. This is an educational summary, not legal advice for your organisation.
Government & public sector: common questions
Is the government exempt from the DPDP Act?
Not generally. Section 17(2)(a) allows the Central Government to notify a specific instrumentality of the State as outside the Act, on grounds including sovereignty and integrity, security of the State and public order. That is body-by-body notification. Absent it, a public body is a Data Fiduciary - though section 7(b) usually gives it a basis to process without consent when providing subsidies, benefits, services, certificates, licences or permits.
Do citizens have rights against a department relying on section 7(b)?
Yes. Section 7 provides a lawful basis for processing without consent; it does not disapply Chapter III. The rights to access information about processing, correction and erasure, grievance redressal and nomination all continue to apply, as do purpose limitation, security safeguards and breach notification.
What are the Second and Seventh Schedules for?
The Second Schedule, via rule 5, sets the standards for State processing under section 7(b). The Seventh Schedule, via rules 23(1) and 8(3), pairs each purpose with the person authorised to act on it and anchors the one-year minimum retention for processing logs. Between them they are the operational detail the Act left to be prescribed.
Know this well enough to prove it
The certification is a free, graded 15-question exam covering the Act end to end, not just this sector. Pass mark is 70%.
DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against Government & public sector implementation guide. Educational information, not legal advice.