Rule 5 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 5 says that when the State or one of its instrumentalities processes a person's personal data to provide or issue a subsidy, benefit, service, certificate, licence or permit, it must follow the standards in the Second Schedule. It also fixes what the phrases "under law", "under policy" and "using public funds" mean.
Rule 5 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. It has two sub-rules. Sub-rule (1): processing "under this rule" is done following the standards specified in the Second Schedule. Sub-rule (2): it defines under law, under policy and using public funds for this rule and the Second Schedule. It serves clause (b) of section 7 of the Act.
What rule 5 is for
Section 7 of the Act lists the uses for which a Data Fiduciary may process personal data without asking for consent. Clause (b) of section 7 covers the State and its instrumentalities providing or issuing a subsidy, benefit, service, certificate, licence or permit that the Rules prescribe. Rule 5 is that prescription. The Act's text is covered in Section 7 of the DPDP Act: voluntary provision and State benefits and, for the neighbouring clauses, legal obligations, courts and State functions. This article explains the Rule; it does not re-explain the section.
Rule 1(4) places rule 5 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. The three stages are set out in our article on rules 1 and 2. The Second Schedule has no commencement line of its own and follows rules 5 and 16.
State bodies and the private contractors that serve them often ask which of their processing falls under rule 5, and a legal consultation can help answer that for a given scheme.
Rule 5(1): the standards
"Processing the personal data of a Data Principal under this rule shall be done following the standards specified in Second Schedule."
The Second Schedule has items (a) to (h). They cover lawful processing, the uses for which the data may be processed, limiting the data to what is necessary, completeness and accuracy, retention, security safeguards, an intimation to the Data Principal with contact details, and accountability. They are explained in our article on rule 16 and the Second Schedule standards. Rule 5 itself adds no standard; it sends the reader to the Schedule.
Rule 5(2): three phrases defined
Rule 5(2) says that "in this rule and the Second Schedule", references to a subsidy, benefit, service, certificate, licence or permit that is provided or issued in three ways are to be read as follows.
| Phrase | Rule | What it is to be read as |
|---|---|---|
| "under law" | 5(2)(a) | Provision or issuance "in exercise of any power of or the performance of any function by the State or any of its instrumentalities under any law for the time being in force" |
| "under policy" | 5(2)(b) | Provision or issuance "under any policy or instruction issued by the Central Government or a State Government in exercise of its executive power" |
| "using public funds" | 5(2)(c) | Provision or issuance "by incurring expenditure on the same from, or with accrual of receipts to" the funds listed in (i) or (ii) |
"Using public funds": which funds
Clause (c) names the funds:
- For the Central Government or a State Government: "the Consolidated Fund of India or the Consolidated Fund of the State or the public account of India or the public account of the State" (clause (c)(i)).
- For "any local or other authority within the territory of India or under the control of the Government of India or of any State": "the fund or funds of such authority" (clause (c)(ii)).
The words "incurring expenditure ... from, or with accrual of receipts to" mean that a scheme counts if money goes out of, or comes into, those funds because of it. A licence fee paid into a Consolidated Fund can therefore be within the phrase even if the State spends nothing on the licence itself.
How the three phrases are used
The Rule does not say that a benefit must meet all three; the clauses are joined by "and", but each defines a separate phrase, and the Second Schedule is where the phrases are used. The text of rule 5 itself does not say which of them is required for the rule to apply. That is a point on which the Rule is silent, and anyone relying on it should read the Second Schedule and the section 7(b) wording together.
Examples
The Rules give no Illustration for rule 5. Our own invented examples:
- A State's housing department issues a building-completion certificate under a State law. That is "under law": the department exercises a power under a law for the time being in force.
- A Central scheme gives a cooking-gas subsidy under a Ministry's instruction. That is "under policy" and likely "using public funds" too, because the cost is met from a Consolidated Fund.
- A municipal body issues a trade licence and collects a fee into its own fund. Clause (c)(ii) covers "the fund or funds of such authority".
The same benefit can be described in more than one of these ways. The Rule does not rank them.
Who is affected
Rule 5 binds the State and its instrumentalities as Data Fiduciaries for these purposes. A private company that runs a portal for a department on its behalf may be a Data Processor; the Second Schedule item (f) mentions processing "undertaken by it or on its behalf by a Data Processor". What the Rules do not do is define "instrumentalities" for this rule; the Act's meaning of "State" is in the section 2 articles, and the Rules use the word "instrumentalities" without definition.
Need help with State-linked processing?
Departments, scheme operators and their vendors often work out which standards apply only after a project begins. Speak to our legal team before you finalise the data flows for a scheme.
Key takeaways
- Rule 5 falls in the group that starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- Processing by the State and its instrumentalities for a subsidy, benefit, service, certificate, licence or permit is to follow the Second Schedule standards.
- "Under law" means the exercise of a power or function under any law for the time being in force.
- "Under policy" means a policy or instruction of the Central Government or a State Government made in exercise of its executive power.
- "Using public funds" means expenditure from, or receipts to, the listed Consolidated Funds, public accounts, or an authority's funds.
- Check later amendments and notifications.
Read next
- Rule 16 and the Second Schedule: research, archiving, statistics and State standards
- Rules 1 and 2: staged commencement and definitions
- Section 7 of the DPDP Act: voluntary provision and State benefits
- Obligations of a Data Fiduciary under section 8
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.