Calling for information from Data Fiduciary or intermediary
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 50 croreAct, Schedule, item 7
- Binds
- Every Data Fiduciary
In plain English
The Central Government, acting through the officers named in the Seventh Schedule, may require any Data Fiduciary or intermediary to furnish information for the purposes listed there: use of personal data in the interest of sovereignty, integrity or security of the State; performance of functions or disclosures required under law; and assessing whether to notify a Significant Data Fiduciary. Where disclosure would prejudice sovereignty, integrity or security, the Government can require the company not to tell the affected person or anyone else without the authorised person's written permission.
What you must do
Create an intake process for s. 36 requests: verify the authorised person, log the request, meet the period given, and honour any non-disclosure direction.
Make sure your transparency reporting can account for requests you are barred from disclosing.
Gazette text · Rule 23The Central Government may, for such purposes of the Act as are specified in Seventh Schedule, acting through the corresponding authorised person specified in the said Schedule, require any Data Fiduciary or intermediary to furnish such information as may be called for, within the specified period as may be given in such.
- (1)The Central Government may, for such purposes of the Act as are specified in Seventh Schedule, acting through the corresponding authorised person specified in the said Schedule, require any Data Fiduciary or intermediary to furnish such information as may be called for, within the specified period as may be given in such.
- (2)Where the disclosure of furnishing of information as referred to in sub-rule (1) is likely to prejudicially affect the sovereignty and integrity of India or security of the State, the Central Government may require the Data Fiduciary or intermediary to not disclose such furnishing to affected Data Principal or any other person except with the previous permission, in writing, of the authorised person.
- (3)For the purposes of this rule, the expression “intermediary” shall have the same meaning as assigned to it in the Information Technology Act, 2000 (21 of 2000).
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log