Rule 23 — Calling for Information From Data Fiduciary or Intermediary

Rule 23 closes out the DPDP Rules, 2025, and it does something none of the preceding twenty-two rules do directly: it gives the Central Government a standing power to demand information from any Data Fiduciary or intermediary, and — in a defined set of circumstances — to legally prevent that demand from being disclosed at all. The two sub-rules work together but create distinct obligations, so it's worth treating them separately.

23(1) — the information-calling power itself

For purposes of the Act specified in the Seventh Schedule, the Central Government — acting through the authorised person the Schedule names for that purpose — may require any Data Fiduciary or intermediary to furnish whatever information is called for, within the period specified in the request. The Seventh Schedule names three purposes and their corresponding authorised person: using a Data Principal's personal data in the interest of India's sovereignty and integrity or State security, through an officer the State or its instrumentality designates (or the Central Government, or the instrumentality's head); using personal data to perform a function under law or to disclose information to fulfil a legal obligation, through a person authorised under the applicable law; and carrying out the assessment behind notifying a Data Fiduciary as a Significant Data Fiduciary, through an officer the MeitY Secretary designates.

This obligation is triggered purely by a lawful direction issued under the Act — it doesn't depend on a Data Principal's consent, on what a processing contract says, or on how quickly an organisation's internal approval chain can move. The scope is broad by design: it reaches any Data Fiduciary and any intermediary, not a narrower regulated category.

23(2) — the non-disclosure direction

Where furnishing that information, if disclosed, is likely to prejudicially affect India's sovereignty and integrity or the security of the State, the Central Government may direct the Data Fiduciary or intermediary not to disclose that it furnished the information — to the affected Data Principal or to anyone else — except with the authorised person's prior written permission. Once such a direction is issued, non-disclosure isn't a discretionary courtesy; it's a legal obligation the organisation has to comply with, including internally, since uncontrolled internal visibility into the request can itself risk an unauthorised disclosure.

23(3) — "intermediary" borrows its meaning from the IT Act

For this rule, "intermediary" carries the same meaning assigned to it under the Information Technology Act, 2000 — so the term reaches the same broad category of entities (hosting providers, network service providers, search engines, and similar) that Act already defines, rather than a term coined fresh for the DPDP Rules.

Why this matters in practice

The operational burden Rule 23(1) creates is real even for an organisation with nothing to hide: you need to be able to identify, retrieve and furnish the requested information within the timeline specified, and inability to do so — fragmented records, manual extraction with no clear owner, delayed responses — creates compliance exposure just as much as an outright refusal would. And a privacy notice that promises "we will always tell you when your data is shared" runs directly into Rule 23(2) — if a non-disclosure direction is ever issued, that promise becomes one the organisation is legally barred from keeping for that specific disclosure, so the underlying system needs a way to suppress notification and restrict internal visibility on a case-by-case basis, not just a blanket transparency commitment with no exception built in.

Illustration: a telecom operator receives a request under Rule 23(1), through the authorised person named in the Seventh Schedule, for subscriber information relevant to State security. It has to furnish that information within the specified period. If the Central Government also issues a non-disclosure direction under Rule 23(2), the operator cannot tell the affected subscribers that their information was furnished — and has to keep that fact restricted internally too, with an auditable record of who approved the disclosure and who has access to know it happened, even though the disclosure itself can never be surfaced to the subscriber without the authorised person's written permission.

How Rule 23 connects to the rest of the Rules and the Act

Rule 23(1)'s third Seventh Schedule purpose — assessing whether to notify a Data Fiduciary as an SDF — links directly to Section 10 of the Act and Rule 13's additional SDF obligations: the information-calling power is partly how the government builds the factual basis for that notification decision in the first place. More broadly, Rule 23 sits at the intersection of the Act's Chapter III exemptions for State processing (Section 17) and the Board's own information-gathering powers under Section 28 — it's a separate, government-directed channel for compelling information, distinct from either of those.