Section 17 of the DPDP Act, 2023: Understanding the Exemptions from Data Protection Obligations

24 Oct 2026 · @Ajit Kakkar · Agreya Legal

Introduction

Section 17 of the Digital Personal Data Protection Act, 2023 (DPDPA) switches off selected obligations for selected purposes; it is not a blanket licence to ignore data protection law. Every company that handles personal data in India should understand its precise contours (exact boundaries).

Ordinarily, processing personal data demands clear notice, free consent, purpose limitation, data minimisation and reasonable security. Section 17 recognises that certain activities, such as litigation, criminal investigation, regulatory oversight, corporate restructuring, national security and research, cannot always function within that ordinary framework.

Yet the law treats these carve-outs with circumspection (careful caution). As the maxim goes, exceptiones sunt strictissimae interpretationis (exceptions must be interpreted most strictly). The reach of any exemption depends on four things:

1. The specific subsection invoked.
2. The purpose for which the data is processed.
3. The conditions attached to that subsection.
4. Whether a government notification is required.

This article, prepared by the data protection team at Agreya Legal, explains each subsection of Section 17 and its interplay (interaction) with Sections 5, 8, 10, 11, 12 and 16 of the DPDPA, together with Rule 16 of the DPDP Rules, 2025.

Section 17 at a Glance

Section 17 has five subsections, and each one disapplies a different set of provisions under a different trigger.

Subsection	Who or what it covers	Provisions disapplied	Trigger
17(1)	Six specified purposes, clauses (a) to (f)	Chapter II (except Sections 8(1) and 8(5)), Chapter III and Section 16	Purpose and necessity; no notification
17(2)(a)	Notified instrumentalities of the State	Entire Act	Central Government notification
17(2)(b)	Research, archiving or statistical purposes	Entire Act	No individual-specific decision; prescribed standards met
17(3)	Notified Data Fiduciaries, including startups	Sections 5, 8(3), 8(7), 10 and 11	Central Government notification
17(4)	The State and its instrumentalities	Sections 8(3), 8(7), 12(3); Section 12(2) where no decision affects the Data Principal	Applies by force of the Act
17(5)	Any Data Fiduciary or class of Data Fiduciaries	Any provision, for a specified period	Notification within five years of commencement

The lesson of this table is simple: no two exemptions are coterminous (identical in scope).

Section 17(1): What Is Switched Off and What Survives

Under Section 17(1), Chapter II (except Sections 8(1) and 8(5)), Chapter III and Section 16 do not apply when personal data is processed for any of six purposes. The rest of the Act continues to operate.

What is switched off:

• Chapter II (Obligations of Data Fiduciaries): notice, consent and the other general obligations, save for the two preserved duties below.
• Chapter III (Rights and Duties of Data Principals): rights such as access, correction and erasure.
• Section 16 (Processing outside India): the cross-border restriction framework.

What survives:

• Section 8(1): the Data Fiduciary remains responsible for compliance, including processing by its Data Processor.
• Section 8(5): the Data Fiduciary must still take reasonable security safeguards to prevent a personal data breach.

This residual (remaining) accountability matters. An exempted company that suffers a breach through lax security cannot shelter behind Section 17, because the duty to protect the data never left it.

The Six Specified Purposes: Clauses (a) to (f)

Each clause applies only where processing is genuinely necessary for the stated purpose. A tenuous (weak or remote) link will not suffice.

Clause (a): Enforcing a Legal Right or Claim

Processing necessary to enforce any legal right or claim is exempt. The law honours the maxim ubi jus ibi remedium(where there is a right, there is a remedy), and a remedy often depends on evidence containing personal data.

Example: A company suing a former employee to recover money may process that employee’s employment records, attendance data, correspondence and payment history. An individual may likewise rely on personal messages or transaction records before a court or tribunal.

The limit: The mere existence of a dispute does not legitimise (make lawful) every processing activity. Collecting unrelated personal information, or using litigation data for a commercial purpose, falls outside this clause. A company should identify the right or claim, the data required, and the nexus (direct connection) between the two.

Clause (b): Courts, Tribunals and Regulatory Bodies

Processing by any court or tribunal, or by any body in India entrusted by law with a judicial, quasi-judicial, regulatory or supervisory function, is exempt where it is necessary to perform that function.

Example: A tribunal deciding a service dispute may examine an employee’s service records, medical documents and salary particulars. A statutory regulator may inspect personal data in a regulated entity’s records.

The limit: This clause protects the adjudicating (deciding) body, not every private party before it. A private lawyer’s processing must be tested separately, usually under clause (a).

Clause (c): Prevention, Detection, Investigation and Prosecution

Processing in the interest of preventing, detecting, investigating or prosecuting any offence or contravention of any law in force in India is exempt. Investigations often need communications, financial transactions, location records and identity documents, and applying ordinary Data Principal rights could frustrate them.

The limit: The clause covers contraventions as well as crimes, but its test is the purpose of processing. It is not a passe-partout (master key) for any organisation that labels its activity an internal inquiry.

Clause (d): Foreign Data Principals under Overseas Contracts

This clause applies only when all three elements coexist:

1. The data concerns Data Principals not within the territory of India.
2. The processing is pursuant to a contract with a person outside India.
3. The processing is carried out by a person based in India.

Example: An Indian technology company providing software development or customer support to a foreign client, processing data of that client’s overseas customers.

The clause sustains India’s IT and BPO export industry. It also avoids duplicative compliance, since such processing is usually governed by foreign law and contract already.

Clause (e): Mergers, Amalgamations and Restructuring

Processing necessary for a scheme of compromise or arrangement, merger, amalgamation, demerger, transfer of undertaking, or division of companies is exempt. The scheme must be approved by a court, tribunal or other competent authority.

Example: On a merger, the entities may need to review employee records, consolidate customer accounts and transfer operational information.

The limit: The exemption is twice conditional: necessity and approval. Advisers should identify the transaction, record the approval, and confine processing to what implements the scheme.

Clause (f): Financial Information of Loan Defaulters

Processing to ascertain the financial information, assets and liabilities of a person who has defaulted on a loan or advance from a financial institution is exempt. “Default” and “financial institution” carry their meanings under Sections 3(12) and 3(14) of the Insolvency and Bankruptcy Code, 2016.

The limit: This clause does not permit unbridled (unrestrained) disclosure of a borrower’s data. It expressly preserves other laws governing disclosure of information, such as banking secrecy obligations.

Section 17(2): Complete Exemption from the Act

Section 17(2) is the widest exemption: where it applies, no provision of the DPDPA applies. Its breadth is matched by strict conditions.

Clause (a): Notified Instrumentalities of the State

The Act does not apply to processing by an instrumentality of the State that the Central Government notifies, in the interest of:

• the sovereignty and integrity of India;
• the security of the State;
• friendly relations with foreign States;
• maintenance of public order; or
• preventing incitement to any cognisable offence relating to any of these.

The exemption also covers personal data furnished to that notified instrumentality by the Central Government. It reflects the venerable (long-respected) maxim salus populi suprema lex esto (the welfare of the people shall be the supreme law).

The limit: The exemption is notification-based. Being a government department does not, by itself, bring every processing activity within clause (a). Both the notification and the national-interest purpose are sine qua non (indispensable conditions).

Clause (b): Research, Archiving and Statistics

Processing necessary for research, archiving or statistical purposes is exempt, subject to two conditions:

1. The data must not be used to take any decision specific to a Data Principal.
2. The processing must follow the standards prescribed for that purpose.

Example: An institution studying broad employment trends, preserving historical records, or compiling population-level statistics may qualify.

The limit: The label “research” or “analytics” is not a talisman (a charm with magical power). If the output drives an individual-specific eligibility decision, the first condition fails and the exemption falls away.

Rule 16 and the Second Schedule: Rule 16 of the DPDP Rules, 2025 gives effect to this exemption where processing is done in accordance with law. The Second Schedule prescribes the standards for processing by the State and its instrumentalities and for purposes under Section 17(2)(b). These standards require appropriate technical and organisational measures.

Section 17(3): Notified Data Fiduciaries, Including Startups

The Central Government may notify certain Data Fiduciaries or classes of them, including startups, as exempt from five specified provisions. It must have regard to the volume and nature of personal data they process.

The provisions that may be disapplied are:

• Section 5: notice to the Data Principal.
• Section 8(3): ensuring completeness, accuracy and consistency of data in specified circumstances.
• Section 8(7): erasure of personal data, and causing the Data Processor to erase it, subject to retention required by law.
• Section 10: additional obligations of Significant Data Fiduciaries.
• Section 11: the right to access information about personal data.

The rationale is pragmatic (practical and sensible). Smaller and newly established businesses lack the compliance capacity of large enterprises, and the law does not demand the impossible: lex non cogit ad impossibilia (the law does not compel the impossible).

The limit: This is again notification-based. No startup is exempt merely because it calls itself one; it must fall within a notified entity or class.

Section 17(4): Processing by the State

Section 17(4) relieves the State and its instrumentalities of certain data-quality and erasure obligations, without any notification. The provisions disapplied are:

• Section 8(3): ensuring completeness, accuracy and consistency where data is likely to affect the Data Principal or is disclosed to another Data Fiduciary.
• Section 8(7): erasure of personal data by the Data Fiduciary and its Data Processor, subject to retention required by law.
• Section 12(2): correcting, completing and updating personal data, but only where the processing does not include making a decision that affects the Data Principal.
• Section 12(3): the Data Principal’s right to request erasure.

The conditional disapplication (switching off) of Section 12(2) is noteworthy. Where the State uses data to decide something about a citizen, the citizen’s right to correction revives.

Section 17(5): Power to Grant Further Exemptions

Before five years expire from the Act’s commencement, the Central Government may notify that any provision of the Act shall not apply to a particular Data Fiduciary, or a class of Data Fiduciaries, for a specified period.

This is a transitional safety valve. It lets the Government calibrate (fine-tune) compliance burdens while the regime beds in, but every such exemption is time-bound and must be notified.

Exemption-Readiness Checklist for Companies

Before relying on any Section 17 exemption, a Data Fiduciary should be able to answer six questions with documents, not assertions. The burden lies on the party claiming the benefit: actori incumbit onus probandi (the burden of proof lies on the one who asserts).

• Purpose: Is the data processed for a legal claim, judicial function, law enforcement, overseas contract, restructuring, loan-default assessment, research, or another specified purpose?
• Identity: Is the entity a private Data Fiduciary, a court or statutory body, a State instrumentality, a financial institution, or a notified entity?
• Scope: Which exact provisions does the chosen exemption disapply?
• Conditions: Does it require a notification, court or tribunal approval, or compliance with prescribed standards, and are these satisfied?
• Continuing obligations: Which provisions, such as Sections 8(1) and 8(5), and which other laws still apply?
• Evidence: Can the company demonstrate the purpose, necessity, legal basis, approvals and notifications it relies on?

Common pitfalls:

1. Treating one qualifying activity as a status that exempts all activities.
2. Continuing to rely on a litigation exemption after the litigation has ended.
3. Assuming a whole mixed dataset qualifies under clause (d).
4. Believing a contract clause can create a statutory exemption.

Frequently Asked Questions

1. Does Section 17 exempt an organisation from the entire DPDPA?

Only Sections 17(2)(a) and 17(2)(b) disapply the entire Act, and both carry strict conditions. Every other subsection disapplies specific provisions only.

2. If a Data Fiduciary qualifies for one exemption, does it cover all its processing?

No. Section 17 is purpose-based, not status-based. A financial institution processing borrower data to assess a loan default does not thereby exempt its marketing, customer profiling or unrelated analytics.

3. Can a company refuse an erasure request merely because the data was once needed for litigation?

No. The company must assess whether processing remains necessary to enforce a legal right or claim. Once the claim is concluded, the justification may evaporate (disappear), and the company should be ready to explain any refusal with documentary support.

4. Can an Indian company invoke Section 17(1)(d) if its client is abroad but the individuals are in India?

No. Clause (d) requires the Data Principals themselves to be outside India. Where a dataset mixes individuals in different locations, the company must assess the exemption against each category of data, not the whole dataset.

5. Can a company contract out of DPDPA obligations through an exemption clause?

No. A private contract cannot create a statutory exemption, because exemptions arise only from the Act. Contracts may allocate responsibilities between parties, but they cannot extinguish (wipe out) obligations the law imposes, nor diminish the rights of Data Principals.

6. Does an exempted Data Fiduciary still need security safeguards?

Yes. Under Section 17(1), Sections 8(1) and 8(5) continue to apply. The Data Fiduciary remains accountable and must maintain reasonable security safeguards.

Conclusion: Exemptions Are Narrow Doors, Not Open Gates

Section 17 balances privacy against litigation, law enforcement, commerce, national security and research. Each exemption, however, is tethered (tied) to a specific purpose, a demonstrable necessity and, often, a notification or approval.

Exceptio probat regulam in casibus non exceptis (the exception confirms the rule in cases not excepted). Outside the precise boundaries of Section 17, the full rigour of the DPDPA applies. Companies that assume a broad exemption without documented justification expose themselves to penalties and litigation.

How Agreya Legal can help: Our data protection team advises companies on assessing exemption eligibility, documenting the legal basis for processing, building DPDPA compliance frameworks, and defending against data protection claims. Contact Agreya Legal for an exemption-readiness assessment.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts