When the Government Asks for Data: What Businesses Must Do
Police notices, intermediary orders, CERT-In directions and, from May 2027, MeitY calls under s.36 all reach private businesses; the DPDP Act gives them a route to comply, but not a reason to hand over more than the law requires.
- CATEGORY
- Article · Government access
- POSITION AS OF
- October 2026
- READING TIME
- 9 min read
- TAGS
- Government access, Law enforcement requests, Exemptions, IT Act, DPDP Act
Introduction
A cyber-crime police station emails a notice asking for a customer's KYC file and login history. CERT-In wants logs by a fixed time. From 13 May 2027, an officer of the Ministry of Electronics and Information Technology (MeitY) may also call for information under s.36 of the Digital Personal Data Protection Act, 2023 (the DPDP Act).
Each demand lands on a data fiduciary (the business deciding why and how personal data is processed) that owes duties to the data principal (the person the data is about). This article takes the business's side: which law lets the State ask, how the DPDP Act treats the answer, and how to respond. Trayambic's study on government bodies and PSUs covers the State's own duties once the data arrives.
The legal position
The DPDP Act
- Grounds for the business. Section 7(d) covers "fulfilling any obligation under any law" in India "on any person to disclose any information to the State or any of its instrumentalities", following that law's disclosure provisions. Section 7(e) covers compliance with "any judgment or decree or order issued under any law". Section 7(c), on State functions, is the receiving agency's ground, not the business's.
- The offences exemption. Section 17(1)(c) disapplies Chapter II (except ss.8(1) and 8(5)), Chapter III and s.16 where data is processed "in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law".
- Notified agencies. Under s.17(2)(a) the Centre may take a State instrumentality outside the Act on grounds such as sovereignty, security of the State and public order, together with the Centre's processing of data that agency furnishes. None had been notified as of October 2026.
- Access summaries. Section 11(2) excuses a fiduciary from listing sharing with a body "authorised by law to obtain" the data, made on "a request made in writing" for offences or cyber incidents.
- Calls for information. Section 36 lets the Centre, "for the purposes of this Act", require any fiduciary or intermediary "to furnish such information as it may call for". Rule 23 of the DPDP Rules, 2025 and its Seventh Schedule set out three purposes, each with an authorised person: State use for sovereignty, integrity or security; State functions or disclosure obligations under law, through a "person authorised under applicable law"; and assessing whether to designate a Significant Data Fiduciary (SDF), through a MeitY officer. Under Rule 23(2), where disclosing that it furnished information "is likely to prejudicially affect the sovereignty and integrity of India or security of the State", the business may be told not to reveal this to the person or anyone else without written permission. Section 36 and Rule 23 commence on 13 May 2027.
The instruments that compel disclosure
| Instrument | Who may demand | What the business must do |
|---|---|---|
| Information Technology Act (IT Act) s.69 and the 2009 interception rules | An agency acting on an order of the Union or State Home Secretary, for grounds from security of the State to "investigation of any offence" | Give facilities and technical assistance to intercept, monitor or decrypt; failure carries up to seven years' imprisonment |
| IT Act s.69B | An agency the Centre authorises by notification, for cyber security | Help it monitor and collect traffic data |
| IT Rules 2021, rule 3(1)(j) | A government agency "lawfully authorised for investigative or protective or cyber security activities", by written order stating its purpose | Intermediaries provide information or assistance within 72 hours |
| IT Act s.79(3)(b) and rule 3(1)(d) | An authorised officer of at least Joint Secretary rank, or Deputy Inspector General for the police | Remove content within three hours; a takedown, not a data demand |
| Bharatiya Nagarik Suraksha Sanhita (BNSS) s.94 | A court, or a police station's officer in charge by written order, physical or electronic | Produce documents, electronic communications or devices "necessary or desirable" for an investigation, inquiry or trial |
| BNSS s.106 | Any police officer | Submit to seizure of property, such as devices, found in circumstances suggesting an offence |
| Telecommunications Act s.20(2) | The Centre, a State or a specially authorised officer, on a public emergency or for public safety | Telecom services intercept or detain messages, or disclose them "in intelligible format" |
| CERT-In Directions, 28 April 2022, under IT Act s.70B | CERT-In | Provide information in the format and time ordered, "up to and including near real-time"; name a point of contact; produce 180 days of logs kept in India |
The intermediary definition in s.2(1)(w) of the IT Act covers anyone who stores or transmits a record on another's behalf and names "online payment sites" and "online-market places", so payment and commerce platforms, and services hosting users' posts, carry the 72-hour duty. G.S.R. 120(E) of February 2026 shortened takedown timelines but left rule 3(1)(j) unchanged.
Analysis
Which DPDP route covers the answer
Trayambic's studies have placed agency disclosures under s.7(d) (social media) and under s.17(1)(c) (matrimonial platforms). In our view both are right, in layers:
- A written demand under a law that compels disclosure, such as rule 3(1)(j) or a s.94 order, supplies a ground under s.7(d), and under s.7(e) where it takes the form of an order.
- Where the demand concerns an offence or contravention, s.17(1)(c) also lifts notice, rights and erasure duties for that processing. Security and responsibility for processors remain.
- An informal request fits neither cleanly. In our view s.17(1)(c) covers a business reporting a crime against itself, but handing a third person's data to a caller who cites no law is weak ground. Ask for the written order.
A notification under s.17(2)(a) takes the agency's processing outside the Act, not the business's disclosure, which still needs one of these routes.
Section 36 is a channel, not a blank cheque
Section 36 is one sentence long, but Rule 23 and its Schedule specify three purposes and named officers. Entry 2 of the Seventh Schedule relies on a "person authorised under applicable law", so in our view it adds no new power: the officer still needs authority under that other law, with its limits. An SDF assessment under entry 3 usually needs volumes, categories and systems, not individuals' records, so answer with aggregates.
In our view the gag in Rule 23(2) is narrow. It needs a direction and a likely prejudice to sovereignty, integrity or security; routine police work does not meet it. Because s.36 sits in Chapter IX, the s.17(1) exemptions do not switch it off, as Trayambic's GDPR comparison notes.
Interception is different from production
Production hands over records; interception gives an agency live access. Under the 2009 rules, orders come from the Union or State Home Secretary, save in emergencies, and intermediaries must keep them secret through designated officers. Telecom services follow the 2024 interception rules under the Telecommunications Act. Courts enforce these conditions: in Vinit Kumar v CBI (22 October 2019) the Bombay High Court quashed telephone interception orders that showed no public-safety basis and ordered the recordings destroyed.
What proportionality lets a business test
K.S. Puttaswamy v Union of India, (2017) 10 SCC 1, requires an intrusion on privacy to meet legality, a legitimate state aim and proportionality, with "procedural guarantees against abuse" (paras 325 and 638). The test binds the State, and a business cannot refuse a valid order because it finds it excessive. It can check what the law itself requires: a written order, a stated purpose, an officer of the right rank and a link between the data sought and the case. In our view it should narrow a demand that asks for more than its purpose needs, in writing, and take legal advice before resisting outright.
Telling the user and the public
No DPDP provision requires telling a person about a disclosure made under s.7(d), s.7(e) or s.17(1)(c): notice attaches to consent, and s.11(2) keeps written offence-related requests out of access summaries. The IT Rules impose no secrecy for rule 3(1)(j); the interception rules and Rule 23(2) directions do. In our view notifying users after the event, unless an order or law forbids it or notice would prejudice the case, is lawful. Transparency reports can count requests by instrument, leaving interception out unless legal advice clears it. A police request to delay breach notices is a separate question; Trayambic's breach-notification framework explains why the Board's intimation is never delayed.
Data filed with the State can travel under RTI
Records a business files can be sought under the Right to Information Act, 2005. If an information officer intends to disclose information a third party supplied and "treated as confidential", it must notify that party within five days and allow ten days to object (s.11). Commercial confidence is protected by s.8(1)(d), and since 13 November 2025 s.8(1)(j) exempts "information which relates to personal information", though s.8(2) still allows disclosure where public interest outweighs the harm. Mark filings confidential to trigger the notice.
Practical implications
Worked example (illustrative). A test-preparation platform with 18 lakh learners runs live classes and a doubt forum where learners post, which in our view makes it an intermediary for the forum. In September 2027:
- A cyber-crime police station emails a s.94 order citing an FIR over a recruitment-exam paper sold through forum messages. It asks for registration details, IP logs and payment records of three adult accounts, and "all forum chats" since January, covering about 40,000 learners. The compliance lead verifies the officer and FIR through published police contacts, sends the three accounts' data within 72 hours under s.17(1)(c) and s.7(d), and preserves the forum. It offers in writing the threads where those accounts posted and asks the officer to name others. The three users are not told while the case is open.
- A MeitY officer designated under entry 3 writes under s.36 to assess SDF status, given the many minors on the platform. The platform answers with learner counts by age band, data categories and hosting locations, sends no learner records, and briefs its board. Trayambic's SDF whitepaper covers what follows.
| Stage | Check | Keep on file |
|---|---|---|
| On receipt | Officer, rank, agency and channel are genuine | Copy of the order and how it was verified |
| Before replying | Law and section, case number, purpose, deadline; whether the data asked for fits the purpose | Scope decision and any written query on overbreadth |
| When sending | Named accounts, fields and dates only; encrypted transfer; a Bharatiya Sakshya Adhiniyam s.63 certificate where records are evidence | What left, when, to whom, approved by whom, under which DPDP route |
| Afterwards | Whether to tell the user: not for interception or where barred or prejudicial | Notice decision and transparency-report entry |
| When the case closes | Lift the preservation hold | Date normal erasure resumed |
Key takeaways
State access in India runs through many statutes; the DPDP Act adds a ground and an exemption, not a new gatekeeper. Demand the written basis, send only what it covers, log every disclosure, and treat s.36 calls as purpose-bound requests that rarely need individuals' records.
- Disclosures compelled by law rest on s.7(d) or (e); offence-related ones also fall within s.17(1)(c), which lifts notice and rights but not security or processor duties.
- From 13 May 2027, s.36 and Rule 23 let named officers call for information for three Seventh Schedule purposes; the non-disclosure direction applies only where sovereignty, integrity or security is at stake.
- Intermediaries, including online payment sites, must answer written agency orders within 72 hours under IT Rules rule 3(1)(j), unchanged by G.S.R. 120(E).
- Puttaswamy binds the State, but a business can insist on a written order, a stated purpose and the right officer, and narrow overbroad demands.
- Keep one request register, decide user notice by policy, and mark filings confidential to trigger the RTI third-party notice.
Anonymisation and Pseudonymisation Under the DPDP Act
The DPDP Act never mentions anonymisation, so whether a dataset escapes it turns on one word in section 2(t), 'identifiable', and on who could do the identifying.
SDKs, Pixels and Trackers: Who Is Responsible Under the DPDP Act?
Every SDK in an app sends data to someone, and the DPDP Act holds the app answerable for what its code collects while making a vendor that uses the data for itself answerable too.
DPDP Act vs Singapore's PDPA: Taking Your Programme Into Asia
An Indian company with a DPDP programme already has most of what Singapore's PDPA asks for, but breach triage, transfers back to India, a DPO and Do Not Call checks are new work.