Rule 5 — DPDP Rules, 2025
Where personal data is processed by the State or its instrumentalities for the purposes specified in section 7(b), such processing shall be subject to such standards and conditions as may be prescribed by the Central Government in the Second Schedule.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 5 operationalises Section 7(b)'s legitimate use for State processing of personal data (for provision of subsidies, benefits, services, certificates, licences, or permits). State processing under Rule 5 does not require consent from the Data Principal — but it must meet the conditions set out in the Second Schedule. The Second Schedule specifies standards for notice, data minimisation, and accountability even in the absence of consent. This rule does not apply to commercial entities — it covers the State and its instrumentalities only.
A State government portal collects Aadhaar, bank account details, and address information to disburse agricultural subsidies. This processing falls under Section 7(b) and Rule 5 — consent is not required because the processing is for a legitimate State use. However, the State must still give a Rule 3 notice and must not retain the data beyond what is necessary for the subsidy purpose.