- Home
- Industries
- DPDP for government contractors
Industry
DPDP for government contractors
System integrators, call centres and service providers run many government schemes and portals. Under DPDP the department usually decides the purpose, and the contractor processes on its behalf.
Short answer
The legitimate uses in s.7(b) and s.7(c) belong to the State and its instrumentalities, for subsidies, benefits, services, certificates, licences, permits and State functions. Contractors running these services usually act as Data Processors, bound by a valid contract with the department (s.8(2)). Rule 5, on processing by the State, and the other core rules begin on 13 May 2027.
Where personal data sits in government contracts
- Scheme databases: beneficiary names, Aadhaar, bank details with IFSC, addresses and entitlement records.
- Citizen portals: applications for certificates, licences and permits, with uploaded documents.
- Helplines: call recordings, grievance tickets and caller numbers.
- Field operations: survey data collected on tablets, photographs and geotags.
- Hosting: data centre and cloud copies, backups, and test environments loaded with real records.
- Sub-contractors: data entry, printing, courier and support partners.
The riskiest copies are often the informal ones: exports made for progress reports, scanned forms on shared drives, and test databases loaded with production records. They need the same controls as the live system.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| State legitimate uses | s.7(b), s.7(c) | The department may rely on these grounds. They belong to the State, not to the contractor's own purposes. |
| Processing by the State | Rule 5 | Covers processing by the State for subsidy, benefit, service, certificate, licence or permit. It begins on 13 May 2027 with the other core rules. |
| Processor contract | s.8(2) | Your contract defines what you may do. Process only on instructions, with no reuse or onward sharing. |
| Security safeguards | s.8(5), Rule 6 | Encryption or masking, access control, logs reviewed and kept for a year, backups and continuity, and terms flowed down to sub-contractors. |
| Breach intimation | s.8(6), Rule 7 | The fiduciary intimates the Board and affected people. It needs your facts fast, so agree a reporting path in the contract. |
| Accuracy | s.8(3) | Scheme data decides who receives a benefit, so the department needs it complete, accurate and consistent. Your data entry and matching processes carry that duty in practice. |
| Contact and grievances | Rule 9, s.8(10) | The fiduciary publishes the contact for questions about processing. A helpline you run should route DPDP questions and grievances to it. |
| Erasure | s.8(7) | When the department's purpose ends or it instructs you, erase, including test copies and backups, as the contract sets out. |
Roles: fiduciary or processor
Where a department decides why and how citizen data is processed, it is the fiduciary and you are its processor. Your duties come through the contract, and the department stays responsible for what you do on its behalf (s.8).
Contractors are fiduciaries for data they use for their own purposes, and always for their own employees. Using scheme data to build a product or train a model for other clients is a new purpose; do not do it without clear written authority.
Do not move data between departments or schemes just because systems are connected. Share only where the instructing fiduciary has told you to, in writing, and check with counsel and the department.
A 90-day starting plan
- 01Days 1 to 30: map each contract
For every contract, list the data sets, the instructing department, the sub-contractors, and where copies sit, including test environments.
- 02Days 31 to 60: tighten controls
Review access, mask identifiers outside production, keep logs for a year, and flow security terms down to sub-contractors.
- 03Days 61 to 90: evidence and response
Build an evidence pack for audits, agree the breach reporting path with each department, and plan return or erasure at contract end.
How TruePrivacy helps
- Data discovery and classification find Aadhaar numbers and Virtual IDs, PAN, voter ID (EPIC), passport, driving licence and IFSC, with samples masked before they leave the source.
- Data security posture shows identities and open links that can reach each store, and tracks remediation from request to verified change.
- Records of processing records each contract's processing; vendors and processors tracks sub-contractors and their contracts.
- The audit trail logs every action with before and after values, exportable as CSV, behind SSO and MFA.
Can a contractor rely on s.7(b)?
s.7(b) is a legitimate use for the State and its instrumentalities. A contractor processing on a department's behalf acts under its contract (s.8(2)), not under a s.7 ground of its own.
Who notifies a breach on a government project?
The fiduciary, usually the department, intimates the Board and affected people under Rule 7. Your contract should require you to report to the department without delay.
What should a contract with a department cover?
Instructions and purpose limits, Rule 6 security safeguards, breach reporting to the department, sub-contractor approval, audit, and return or erasure at the end. Our processor addendum template is a starting point.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin