Rule 23 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 23 lets the Central Government, for the purposes listed in the Seventh Schedule and acting through the authorised person named there, require any Data Fiduciary or intermediary to furnish information. It can also require them not to disclose that the information was sought. The Schedule has three entries, each with a purpose and an authorised person.
Rule 23 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. The Central Government may, for the purposes in the Seventh Schedule, acting through the corresponding authorised person, require a Data Fiduciary or intermediary to furnish information. Where disclosure of the request would prejudicially affect sovereignty and integrity of India or security of the State, it may require non-disclosure except with the authorised person's previous written permission. The Schedule also supplies the purposes for the one-year retention in rule 8(3).
Rule 23 and the Act
Section 36 of the Act allows the Central Government to call for information from the Board, a Data Fiduciary or an intermediary for the purposes of the Act; see Sections 34 to 36 of the DPDP Act: penalties fund, good faith and power to call for information. The Seventh Schedule also refers to clause (a) of sub-section (2) of section 17, covered in Section 17(2): State security, research and statistics, and to notifying a Significant Data Fiduciary, covered in section 10. This article explains what the Rules add.
Rule 1(4) places rule 23 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. The Seventh Schedule has no commencement line of its own and follows rules 23 and 8(3). See rules 1 and 2.
Companies that hold large volumes of user data may receive such requests, and dispute resolution advice on how to respond within the law is useful.
Rule 23(1): the power to require information
"The Central Government may, for such purposes of the Act as are specified in Seventh Schedule, acting through the corresponding authorised person specified in the said Schedule, require any Data Fiduciary or intermediary to furnish such information as may be called for, within the specified period as may be given in such."
Drafting slip: the sentence stops at "within the specified period as may be given in such". The word that should follow "such" is missing. Read plainly, the requirement carries a period within which the information is to be furnished. The Rules do not state the period.
Four parts:
- Who calls: the Central Government, "acting through the corresponding authorised person" in the Schedule.
- For what: only the purposes specified in the Seventh Schedule.
- From whom: "any Data Fiduciary or intermediary".
- What: "such information as may be called for", within a period given in the requirement.
Rule 23(2): non-disclosure
"Where the disclosure of furnishing of information as referred to in sub-rule (1) is likely to prejudicially affect the sovereignty and integrity of India or security of the State, the Central Government may require the Data Fiduciary or intermediary to not disclose such furnishing to affected Data Principal or any other person except with the previous permission, in writing, of the authorised person."
Drafting slip: "the disclosure of furnishing of information" is awkward; it means disclosing that the information was furnished.
| Element | Text |
|---|---|
| Condition | Disclosure "is likely to prejudicially affect the sovereignty and integrity of India or security of the State" |
| What the Central Government may require | The Data Fiduciary or intermediary "to not disclose such furnishing" |
| To whom the bar applies | "affected Data Principal or any other person" |
| Exception | "the previous permission, in writing, of the authorised person" |
The bar is conditional. It applies only where the likely prejudice to sovereignty and integrity of India or security of the State is made out, and it is the Central Government that "may require" it. Nothing in rule 23(2) bars disclosure in the ordinary case.
Rule 23(3): "intermediary"
"For the purposes of this rule, the expression 'intermediary' shall have the same meaning as assigned to it in the Information Technology Act, 2000 (21 of 2000)." The Act is cited by name and number; nothing from inside it is described here. For context, see safe harbour for online intermediaries.
The Seventh Schedule
The Schedule is headed "". It has three entries.
| S. no. | Purpose | Authorised person |
|---|---|---|
| 1 | Use, by the State or any of its instrumentalities, of personal data of a Data Principal in the interest of sovereignty and integrity of India or security of the State | Such officer of the State or of any of its instrumentalities notified under clause (a) of sub-section (2) of section 17 of the Act, as the Central Government or the head of such instrumentality, as the case may be, may designate in this behalf |
| 2 | Use, by the State or any of its instrumentalities, of personal data of a Data Principal for (i) performance of any function under any law for the time being in force in India; or (ii) disclosure of any information for fulfilling any obligation under any law for the time being in force in India | Person authorised under applicable law |
| 3 | Carrying out assessment for notifying any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary | Such officer of the Central Government, in the Ministry of Electronics and Information Technology, as the Secretary in charge of the said Ministry may designate in this behalf |
Entry 1: sovereignty, integrity and security
The purpose is use of a Data Principal's personal data by the State or an instrumentality "in the interest of sovereignty and integrity of India or security of the State". The authorised person is an officer notified under clause (a) of section 17(2) of the Act, designated by the Central Government or the head of the instrumentality. No such notification is in the Rules, so none is described.
Entry 2: functions and obligations under law
Two purposes: performing "any function under any law for the time being in force in India", or disclosing information to fulfil "any obligation under any law for the time being in force in India". The authorised person is a "person authorised under applicable law". The Rules do not name the person.
Entry 3: assessing a Significant Data Fiduciary
The purpose is "carrying out assessment for notifying any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary". The authorised person is an officer of the Ministry of Electronics and Information Technology designated by the Secretary. So a company may be asked for information to enable the assessment of whether it should be notified. Any notification is for the Central Government and is not in the Rules; the duties that follow are in rule 13.
The link to rule 8(3)
The Schedule's heading also refers to rule 8(3), which requires a Data Fiduciary to retain personal data, traffic data and logs for a minimum of one year "for the purposes as specified in the Seventh Schedule". So these three purposes are the reason for the one-year retention; see rule 8(3). Note: the heading reads "", while rule 8(3) itself says the retention is for the purposes in the Seventh Schedule; the two fit together.
Example
An invented e-commerce platform, TradeBazaar, receives a requirement through an authorised person under entry 3 to furnish information for an assessment of whether it should be notified as a Significant Data Fiduciary. It furnishes the information within the period in the requirement. In another case a requirement under entry 1 carries a rule 23(2) direction not to disclose; TradeBazaar does not tell the affected users without the authorised person's written permission. The example is ours; the Rules contain no Illustration for rule 23.
What the Rules do not say
They do not state the period for furnishing information, a form of requirement, or a penalty for non-compliance within the Rules; for the Act's penalties see the Schedule to the Act. They do not list any authorised person by name. Later amendments and notifications should be checked.
Need help responding to a requirement for information?
A request to furnish information or not to disclose it raises questions about scope, timing and records. Talk to our dispute resolution team before you reply.
Key takeaways
- Rule 23 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- The Central Government acts through the authorised person for the purposes in the Seventh Schedule.
- It may require any Data Fiduciary or intermediary to furnish information within the period given.
- It may require non-disclosure where disclosure is likely to prejudicially affect sovereignty and integrity of India or security of the State.
- The Schedule has three entries; the same purposes govern the one-year retention in rule 8(3).
- "Intermediary" takes its meaning from the Information Technology Act, 2000.
- Later amendments and notifications should be checked.
Read next
- Rule 8(3): one-year retention of personal data, traffic data and logs
- Rule 13: Significant Data Fiduciary duties
- Sections 34 to 36 of the DPDP Act: power to call for information
- Section 10 of the DPDP Act: notifying a Significant Data Fiduciary
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.