Rule 5 — Processing of Personal Data for Provision or Issue of Subsidy, Benefit, Service, Certificate, Licence or Permit by State and Its Instrumentalities

Section 7(b) of the Act lets the State and its instrumentalities process personal data without consent for the purpose of providing or issuing a subsidy, benefit, service, certificate, licence or permit. Rule 5 is the operational detail behind that legitimate use — it doesn't expand or narrow who can rely on Section 7(b), but it fixes exactly what "under law," "under policy," and "using public funds" mean in that context, and it makes clear that skipping consent doesn't mean skipping every safeguard.

The condition that gets missed — Rule 5(1)

Rule 5(1) states plainly that processing under this rule has to follow the standards in the Second Schedule. That's the detail easiest to overlook in a rule mostly read as "government doesn't need consent" — the actual text replaces consent with an enforceable standards framework, not with nothing. The right question isn't whether the State can process without consent here; Section 7(b) already answers that. The right question is whether a specific instance of that processing actually meets the Second Schedule's standards.

What the Second Schedule requires instead of consent

Even without individual consent, the Second Schedule requires processing to be lawful, limited to the specific uses under Section 7(b) (or the equivalent research/archiving/statistical purposes under Section 17(2)(b)), scoped to only the personal data necessary for that use, carried out with reasonable efforts toward completeness, accuracy and consistency, retained only as long as the purpose or applicable law requires, and protected by reasonable security safeguards. Where processing falls under Section 7(b) specifically, the Second Schedule also requires an intimation to the Data Principal that includes business contact information for someone able to answer her questions, and the specific communication link or other means by which she can exercise her rights under the Act. Consent is absent; purpose limitation, minimisation, retention discipline, security, an intimation, and a route to exercise rights are not.

Three ways a use case has to qualify — Rule 5(2)

Rule 5(2) defines the three bases on which a subsidy, benefit, service, certificate, licence or permit counts as falling under this rule. "Under law" means it's provided or issued in exercise of a power or function the State or its instrumentalities hold under any law currently in force. "Under policy" means it's provided or issued under a policy or instruction the Central or a State Government has issued in exercise of its executive power — a formally issued policy, not an informal internal practice or ad hoc directive. "Using public funds" means the expenditure comes from, or the receipts accrue to, the Consolidated Fund or public account of India or a State, or the funds of the relevant local or other authority. A use case has to clear one of these three gates before Rule 5 applies to it at all; something that's neither legally anchored, policy-authorised, nor tied to public expenditure falls outside this rule entirely and needs its own separate lawful basis.

Why this matters in practice

The risk Rule 5 is built to guard against isn't the initial collection — it's scope creep afterward. Data collected to administer a public subsidy or service, once it exists in a government database, is sometimes reused for a secondary purpose the original collection was never scoped to cover. That reuse is exactly where processing exits Rule 5's legitimate-use basis and needs its own separate justification; the Second Schedule's purpose-limitation standard doesn't travel with the data into whatever new use someone finds for it later.

Illustration: a state government collects Aadhaar-linked personal data to administer a food-subsidy scheme, relying on Section 7(b) and this rule as the basis for processing without individual consent. If a different department later wants to use that same dataset to target a beneficiary with an unrelated welfare scheme's outreach, that's a new purpose the original Second Schedule scoping never covered — it needs its own basis, not a ride on the subsidy scheme's original authorisation.

How Rule 5 connects to the rest of the Rules and the Act

Rule 5 operationalises Section 7(b)'s legitimate use, and the Second Schedule it points to does double duty — Rule 16 applies the same Second Schedule standards to the separate research, archiving and statistical purposes exemption under Section 17(2)(b). Rule 6's security safeguards and Rule 8's retention timelines are the general-purpose counterparts to what the Second Schedule already demands in this specific government-processing context.