On this page
- How the DPDP Act treats law-enforcement and judicial disclosures
- What exemptions never waive: processor responsibility and security safeguards
- Where investigative requests meet the one-year log retention rule
- Why businesses need a written law-enforcement intake protocol
- Our view: a six-step investigative disclosure checklist for compliance teams
- Common questions
- In the news
- Sources
When a business in India receives a written notice, summons or investigation request from a police cyber cell, a court, a tribunal or a statutory regulator asking for customer records, employee logs or transaction histories, the legal and compliance teams face an immediate question: does the Digital Personal Data Protection Act, 2023 allow sharing that personal data without the individual's consent, and what safeguards still apply? As petitions before the Supreme Court seek clearer procedural guidelines on how investigating agencies collect digital devices and personal data, understanding how the DPDP Act and the DPDP Rules, 2025 regulate investigative disclosures is essential ahead of 13 May 2027.
How the DPDP Act treats law-enforcement and judicial disclosures
In ordinary commercial operations, a Data Fiduciary processes personal data either with the individual's free, specific and informed consent or for one of the listed legitimate uses. However, the statute recognises that companies and public bodies must also respond to courts, tribunals and authorised investigative agencies.
The exemptions chapter of the Act creates specific carve-outs where the notice, consent and individual rights provisions do not apply:
- Enforcing a legal right or claim: Processing personal data is exempt where it is necessary for enforcing any legal right or claim, such as recovering a defaulted loan, defending a civil suit or pursuing a contract dispute.
- Courts, tribunals and regulatory bodies: Processing is exempt when done by any court or tribunal, or any other body in India entrusted by law with the performance of any judicial, quasi-judicial, regulatory or supervisory function, where such processing is necessary for that function.
- Prevention, detection, investigation or prosecution of offences: Processing is exempt where personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India.
What exemptions never waive: processor responsibility and security safeguards
A critical feature of the Indian statute—often missed in casual summaries—is that the investigative and judicial exemptions do not waive the entire Act. The opening words of the exemption provision preserve two core statutory duties even when data is processed for an investigation or legal claim:
- The Data Fiduciary remains legally responsible for complying with the Act and the Rules across its own systems and any Data Processor it engages.
- The Data Fiduciary must continue to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent a personal data breach, which carries a penalty ceiling of up to ₹250 crore.
In practical terms, even if a bank, telecom operator, hospital or e-commerce platform is lawfully compiling customer records to answer a police or regulatory requisition, sending those records in an unencrypted spreadsheet over an open chat group or leaving them in a public download folder violates the duty to maintain reasonable security safeguards.
Where investigative requests meet the one-year log retention rule
The DPDP Rules connect directly to statutory requisitions through the mandatory one-year retention floor and the Seventh Schedule. Every Data Fiduciary must retain personal data, associated traffic data and processing logs for a minimum period of one year from the date of processing for the purposes specified in the Seventh Schedule—including processing by the State or its instrumentalities in the interest of sovereignty, security of the State, performance of legal functions or statutory disclosures—after which the data and logs must be erased unless another law requires longer retention.
| Investigative or legal scenario | Records typically requested | Required DPDP Act and Rules control |
|---|---|---|
| Police cyber-cell or law-enforcement notice | Subscriber login timestamps, IP addresses, payment references, account-holder contact details | Verify the written legal authority and scope; disclose only the specific records requested over an encrypted, access-controlled channel |
| Court, tribunal or arbitrator order | Contract files, customer ledger histories, service logs, grievance correspondence | Place the relevant account records under legal hold so automated retention scripts do not erase them during proceedings |
| Sector regulator or supervisory inspection | Audit logs, vendor lists, sample customer onboarding records, incident reports | Provide role-restricted read access or encrypted exports; log every export in your one-year visibility register |
| Internal fraud inquiry or legal-claim recovery | Defaulted borrower files, chargeback evidence, suspicious transaction trails | Restrict internal access to authorised legal and risk officers; keep recovery vendors under a signed Data Processor contract |
| Foreign government or overseas agency demand | Customer data stored on Indian or cross-border cloud servers requested by a foreign authority | Check central government requirements before making personal data available to any foreign State or its agency |
| Post-investigation closure and archival | Exported investigation bundles, temporary forensic copies, closed requisition tickets | Erase temporary working copies once the legal hold ends while preserving mandatory one-year audit logs |
Why businesses need a written law-enforcement intake protocol
Without a clear internal procedure, branch managers, customer-support leads or IT administrators may either hand over broad database dumps on an unverified phone call or unlawfully refuse a valid statutory requisition. Neither extreme is safe. Over-disclosing records that were never requested exposes the organisation to unauthorized-processing claims, while failing to preserve one-year traffic and access logs leaves the company unable to answer a lawful order.
Our view: a six-step investigative disclosure checklist for compliance teams
In our view, general counsel, data protection leads and security officers should put six controls in place before 13 May 2027:
- Route every police, court, tribunal or regulator request to a single designated legal and privacy desk rather than letting branch staff or support agents reply directly.
- Verify that each request is in writing, cites the applicable statutory provision or judicial order, and comes from an verified official domain or authorised officer.
- Scope the extraction strictly to the named accounts, date ranges and fields specified in the order—never export an entire customer table when only two rows were requisitioned.
- Place accounts subject to an active investigation or litigation on an immediate legal hold so scheduled erasure jobs do not delete required evidence.
- Deliver requisitioned files only through encrypted, password-protected channels, and record the disclosure in your immutable one-year audit log.
- Train your cloud and software Data Processors never to hand over your customer data directly to third parties without notifying you unless prohibited by law.
Common questions
Can an Indian business share customer personal data with investigating agencies without the customer’s consent?
Yes, where the processing is necessary in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law in force in India, or for judicial, quasi-judicial, regulatory or supervisory functions.
Do the investigative or judicial exemptions waive the duty to protect personal data with security safeguards?
No. The exemption provision explicitly preserves the Data Fiduciary’s overall responsibility for Data Processors and its duty to protect personal data through reasonable security safeguards to prevent a personal data breach.
Why must businesses retain traffic data and processing logs for at least one year under the DPDP Rules?
The Rules require every Data Fiduciary to retain personal data, associated traffic data and processing logs for a minimum of one year for the State and statutory purposes listed in the Seventh Schedule, and also to detect unauthorized access.
What happens if a foreign government or overseas agency asks an Indian business for personal data?
The Rules empower the Central Government to specify requirements that a Data Fiduciary must meet before making personal data available to any foreign State or its agency or instrumentality.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 04: Set the rules, in the toolkit
- How-to 06: Keep only as long as needed, in the toolkit
- The free duties list, every duty in plain words
In the news
Plea seeks SC safeguards on personal digital data access
Reports a Supreme Court petition seeking clear judicial safeguards on how investigating authorities access and seize personal digital data.
DPDP Act & Rules takeaway: Connects directly to our analysis of DPDP Section 17(1)(c) investigative exemptions, mandatory Section 8(5) security safeguards, and Rule 8(3) 1-year log retention.
View statutory briefing illustration
Source & Courtesy Reference: Dailyhunt (original report)Petition in Supreme Court Seeks Guidelines for Personal Data Collection During Investigations
Supreme Court petition seeks procedural guidelines governing how investigating agencies seize digital devices and collect personal data during criminal inquiries.
DPDP Act & Rules takeaway: Our article explains how DPDP Section 17(1)(c) investigative exemptions work, why Section 8(5) security safeguards are never waived, and how Rule 8(3) 1-year log retention applies.
View statutory briefing illustration
Source & Courtesy Reference: Lokmat Times (original report)
Videos
Sources
Every section, rule and date above was checked against the official text on 25 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 8(1)Responsibility of Data Fiduciary for compliance across Data Processors
- Section 8(5)Duty to protect personal data by taking reasonable security safeguards
- Section 8(7)Erasure of personal data unless retention is necessary for compliance with any law
- Section 17(1)(a)Exemption where processing is necessary for enforcing any legal right or claim
- Section 17(1)(b)Exemption for processing by any court, tribunal or body entrusted with judicial, quasi-judicial, regulatory or supervisory functions
- Section 17(1)(c)Exemption for processing in the interest of prevention, detection, investigation or prosecution of any offence or contravention of law
- The Schedule, item 1Penalty ceiling up to ₹250 crore for breach of reasonable security safeguards
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 6(1)Encryption, access controls, visibility logs, backups, one-year log retention and processor contract clauses
- Rule 8(3)Minimum one-year retention of personal data, traffic data and logs for Seventh Schedule purposes
- Rule 15Requirements for making personal data available to any foreign State or its agency
- Seventh ScheduleState and statutory purposes for minimum one-year retention of data and logs
Notifications
- G.S.R. 843(E), clause (c)Substantive security, retention and exemption provisions in force from 13 May 2027
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
