Rule 23 — DPDP Rules, 2025
(1) The Central Government or a competent authority may, by order, call upon any Data Fiduciary or intermediary to furnish in such form and within such period as may be specified, any information as may be required. (2) The order under sub-rule (1) may direct the recipient not to disclose the fact of receipt of such order or its contents to any person.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 23 is the information demand rule — the final rule in the set and one of the most consequential. The Central Government or a competent authority can demand any information from any Data Fiduciary, in any form, within any specified period. Critically, Rule 23(2) can include a non-disclosure order — the recipient of such a demand may be legally required not to tell anyone (including their customers, counsel, or board) that they received the demand. This is a significant operational and legal risk for Data Fiduciaries to understand and have legal advice on.
A Data Fiduciary receives a Rule 23 order requiring it to furnish all personal data relating to a specific category of user, along with a direction not to disclose receipt of the order. The organisation cannot tell its users, cannot publish a transparency report about the demand, and may not be able to inform its board without legal advice on the scope of the non-disclosure direction.