Understanding Exemptions Under Section 17 of the DPDP Act, 2023: A Complete Guide to Data Protection in India

A Complete Guide to Data Protection in India

Published by: AgreyaLegal | Data Protection and Privacy Law

Introduction

The use of digital personal data has become an essential part of modern business, government administration, legal proceedings and financial transactions. However, collecting and processing personal information also raises important questions about privacy, security and individual rights.

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a legal framework for protecting digital personal data while allowing its lawful use for specified purposes.

However, does every organisation need to follow every data protection requirement in every situation? Can a company use personal information without obtaining consent when it is involved in litigation? Can courts, investigating agencies, financial institutions or research organisations receive exemptions from certain obligations?

Section 17 of the DPDP Act addresses these questions by providing exemptions for specific activities and circumstances.

These exemptions are important because certain activities, such as enforcing legal rights, investigating offences, restructuring companies and conducting qualifying research, may require the processing of personal information under different conditions.

At the same time, an exemption from data protection obligations is not an unrestricted licence to collect, use or disclose personal information. The applicable statutory conditions, purpose of processing and other relevant laws must be carefully considered.

This article explains Section 17 of the DPDP Act in simple language, with practical examples relevant to businesses, legal professionals, financial institutions and individuals.

Important legal update: The DPDP Act and the DPDP Rules, 2025 have a phased commencement schedule. As of October 2026, Section 17 is enacted but its substantive provisions are scheduled to commence 18 months after the notification dated 13 November 2025, that is, on 13 May 2027. The commencement status should be checked again before relying on these provisions in a live matter.

1. What is Section 17 of the DPDP Act, 2023?

Section 17 deals with exemptions from the application of certain provisions of the DPDP Act.

The general framework of data protection includes obligations concerning notice, consent, lawful processing, security safeguards and the rights of individuals whose personal data is processed.

However, applying every ordinary requirement in precisely the same manner to every activity may create difficulties in certain legally recognised situations.

For example:

• A company may need employee records and emails to enforce a contractual claim.
• A court or tribunal may need medical records and service documents to decide a dispute.
• An investigating agency may need digital communications to investigate an alleged offence.
• A company undergoing an approved merger may need to examine employee and customer records.
• A research institution may need personal data to prepare statistics or conduct qualifying research.

Section 17 identifies circumstances in which specified provisions of the Act do not apply.

The scope of the exemption depends on the relevant subsection, the purpose of processing and any conditions prescribed by law.

2. Exemption for Enforcing Legal Rights or Claims-Section 17(1)(a)

One of the most important exemptions concerns the processing of personal data necessary for enforcing a legal right or claim.

Legal proceedings frequently require the use of personal information to establish facts, prove liability, calculate financial claims or enforce judgments.

Example: Employment dispute

Suppose an employer initiates proceedings against a former employee for recovery of money allegedly due under a contract.

The employer may need to examine employment records, salary statements, attendance records, emails and relevant correspondence to establish its claim.

Similarly, an employee pursuing unpaid salary or wrongful termination proceedings may need to rely on appointment letters, service records, performance appraisals and communications with the employer.

Where processing is necessary for enforcing the relevant legal right or claim, Section 17(1)(a) may provide an exemption from the specified provisions of the DPDP Act.

Does the exemption apply to all litigation-related data?

No. The existence of a dispute does not automatically justify every instance of data processing.

The information must have a genuine and necessary connection with enforcing the legal right or claim. Collecting unrelated personal information or using litigation as a pretext for an unrelated commercial purpose cannot automatically be justified.

Organisations should therefore identify the legal claim, determine what information is reasonably required and maintain records explaining the purpose of processing.

3. Exemption for Courts, Tribunals and Regulatory Bodies-Section 17(1)(b)

Courts, tribunals and certain statutory bodies regularly handle sensitive personal information while performing their legal functions.

Section 17(1)(b) addresses processing by:

• Courts and tribunals in India.
• Other bodies in India entrusted by law with judicial or quasi-judicial functions.
• Bodies entrusted by law with regulatory or supervisory functions.

The processing must be necessary for performing the relevant function.

Example: Proceedings before a tribunal

A tribunal deciding a service dispute may need to examine an individual’s service records, medical documents, salary particulars and pension calculations.

Similarly, a regulatory authority investigating non-compliance may need access to personal information contained in an organisation’s records.

The provision recognises the need to process such information for the lawful discharge of these functions.

Does this automatically exempt private lawyers?

No. A private advocate or law firm should not assume that every activity undertaken in connection with litigation automatically qualifies under Section 17(1)(b).

The provision specifically concerns processing by the identified courts, tribunals and other legally entrusted bodies. A private lawyer’s processing may need to be examined separately, including under the exemption relating to enforcement of legal rights or claims.

For law firms, this distinction is important when handling client files, witness statements, identity documents, medical records and electronic evidence.

4. Exemption for Prevention and Investigation of Offences-Section 17(1)(c)

Investigations into offences and legal contraventions may require the collection, preservation, examination and disclosure of personal information.

Section 17(1)(c) addresses the processing of personal data in the interest of:

• Prevention of an offence or legal contravention.
• Detection of an offence or legal contravention.
• Investigation of an offence or legal contravention.
• Prosecution of an offence or legal contravention.

Example: Digital evidence in a criminal investigation

During an investigation into suspected financial fraud, relevant authorities may need to examine transaction records, communications, identity information and other digital evidence.

The provision recognises that ordinary data protection requirements may need to be modified for qualifying investigative and prosecutorial purposes.

However, the mere assertion that an organisation is conducting an internal inquiry does not automatically establish an exemption.

The purpose and circumstances of processing must fall within the statutory provision.

Organisations should also consider other applicable laws governing investigations, confidentiality, evidence and disclosure of information.

5. Exemption for Certain Overseas Contracts- Section 17(1)(d)

Indian businesses often provide information technology, software development, customer support and data-processing services to overseas clients.

Section 17(1)(d) addresses a specific category of such arrangements.

The provision applies where:

1. The personal data relates to a Data Principal who is outside India.
2. Processing takes place pursuant to a contract entered into with a person outside India.
3. The processing is carried out by a person based in India.

Example: An Indian IT services company

An Indian technology company provides customer-support services to a business based in another country. In doing so, it processes personal information relating to individuals located outside India.

If the statutory conditions are satisfied, the processing may fall within this exemption.

However, the exemption should not automatically be extended to all data held by the company.

Where a dataset contains information relating to individuals in India and outside India, the company should assess the relevant processing activities separately.

Businesses should also review their contractual confidentiality obligations, information security arrangements and any other applicable legal requirements.

6. Exemption for Mergers and Corporate Restructuring-Section 17(1)(e)

Corporate transactions frequently require detailed examination of business records and personal information.

Section 17(1)(e) addresses processing necessary for specified corporate arrangements, including:

• Schemes of compromise or arrangement.
• Mergers and amalgamations.
• Reconstruction through demerger or otherwise.
• Transfers of undertakings between companies.
• Specified transactions involving the division of companies.

The relevant transaction must have the approval required under the provision from a competent court, tribunal or other authority.

Example: Merger of two companies

Suppose two companies are undergoing an approved merger.

The companies may need to examine employee records, contractual obligations, customer accounts, outstanding payments and other operational information to implement the transaction.

Processing necessary for the qualifying transaction may fall within the exemption, subject to the statutory conditions.

The exemption does not mean that every use of employee or customer information during the merger is automatically justified.

Companies and their legal advisers should identify the transaction, verify the necessary approval and limit data processing to the relevant purpose.

7. Exemption for Financial Information of Loan Defaulters-Section 17(1)(f)

Financial institutions may need to examine a borrower’s financial position when the borrower defaults on repayment of a loan or advance.

Section 17(1)(f) provides for processing personal data to ascertain the financial information, assets and liabilities of a person who has defaulted on a payment due in respect of a loan or advance taken from a financial institution.

The terms “default” and “financial institution” are linked to the definitions contained in the Insolvency and Bankruptcy Code, 2016.

Example: Recovery of a defaulted loan

A borrower defaults on repayment of a bank loan. The bank needs to examine the borrower’s financial information and assets and liabilities for the qualifying purpose.

The processing may fall within the exemption if the statutory requirements are satisfied.

However, the provision expressly preserves compliance with other applicable laws governing the disclosure of information or data.

It should not be treated as unrestricted permission to publish a borrower’s personal information, disclose it to unrelated parties or use it for unrelated marketing activities.

Financial institutions should carefully distinguish legitimate recovery-related processing from other uses of customer data.

8. Exemption for Certain Government and State Activities- Section 17(2)(a)

Section 17(2)(a) addresses processing by an instrumentality of the State that the Central Government may notify for specified national-interest purposes.

These purposes include:

• Sovereignty and integrity of India.
• Security of the State.
• Friendly relations with foreign States.
• Maintenance of public order.
• Preventing incitement to a cognizable offence relating to these matters.

The provision also addresses the processing by the Central Government of personal data furnished to it by such an instrumentality.

Is every government department automatically exempt?

No. The provision is notification-based and linked to specified purposes.

The fact that an organisation is a government department or State instrumentality does not, by itself, establish that all its personal-data processing falls within this exemption.

The relevant notification and statutory conditions must be examined.

9. Exemption for Research, Archiving and Statistical Purposes -Section 17(2)(b)

Research, historical preservation and statistical analysis may require the processing of personal information.

Section 17(2)(b) provides an exemption for personal-data processing necessary for research, archiving or statistical purposes, subject to two important conditions:

1. The personal data must not be used to take a decision specific to a Data Principal.
2. The processing must comply with the prescribed standards.

Example: Employment research

A research institution studies employment patterns across different industries using personal data to identify broader trends.

If the statutory conditions and prescribed standards are satisfied, the processing may qualify for the exemption.

However, suppose the same information is used to decide whether a particular individual should receive a promotion, loan or benefit. The processing would require a different assessment because it involves an individual-specific decision.

The description of an activity as “research” or “analytics” does not, by itself, establish eligibility for the exemption.

What do the DPDP Rules, 2025 require?

Rule 16 of the Digital Personal Data Protection Rules, 2025 addresses the exemption for research, archiving and statistical purposes. The Second Schedule prescribes standards relating to lawful processing, purpose limitation, data minimisation, accuracy, retention and security measures.

Research organisations should assess the applicable standards before relying on this exemption.

10. Can Startups Receive Exemptions Under Section 17(3)?

Startups and smaller businesses may have different compliance capacities from large organisations.

Section 17(3) empowers the Central Government, having regard to the volume and nature of personal data processed, to notify certain Data Fiduciaries or classes of Data Fiduciaries, including startups, for specified exemptions.

The provisions identified in this subsection concern:

• Section 5: Notice to the Data Principal.
• Section 8(3): Completeness, accuracy and consistency of personal data in specified circumstances.
• Section 8(7): Erasure of personal data, subject to the statutory framework.
• Section 10: Additional obligations of Significant Data Fiduciaries.
• Section 11: Right to access information about personal data.

The availability of these exemptions depends on the applicable government notification.

Not every startup is automatically exempt from DPDP Act compliance.

A business should verify whether a relevant notification applies to it and whether its activities fall within the scope of that notification.

11. Specific Exemptions for the State – Section 17(4)

Section 17(4) provides certain exemptions for processing by the State or its instrumentalities.

These relate to specified obligations under Sections 8 and 12, including:

• Section 8(7): Erasure of personal data, subject to the statutory framework.
• Section 12(2): Correction, completion or updating of personal data where the processing does not include making a decision affecting the Data Principal.
• Section 12(3): The right to request erasure of personal data.

The precise scope of these exemptions depends on the statutory wording and the circumstances of processing.

In particular, the exemption concerning Section 12(2) is linked to processing for a purpose that does not include making a decision affecting the individual.

This provision should not be interpreted as a blanket exemption for every government activity or as removing all data protection responsibilities of the State.

12. Can the Central Government Grant Further Exemptions?

Section 17(5) empowers the Central Government, by notification and within the statutory time limit specified in the provision, to declare that any provision of the Act will not apply to a particular Data Fiduciary or class of Data Fiduciaries for a specified period.

This power is subject to the requirements of the Act and the relevant notification.

Businesses should therefore monitor applicable government notifications rather than assume that an exemption is available simply because an organisation belongs to a particular industry.

13. Practical Compliance Checklist: Before Relying on a DPDP Exemption

An organisation considering an exemption should undertake a structured assessment.

Step 1: Identify the purpose

Determine whether the processing relates to litigation, judicial functions, investigation, an overseas contract, corporate restructuring, loan default, research or another purpose specified in Section 17.

Step 2: Identify the relevant provision

Identify the precise subsection and determine which obligations are excluded from application.

Step 3: Verify the conditions

Check whether the exemption requires a specific approval, government notification or compliance with prescribed standards.

Step 4: Limit the data processed

Identify the information genuinely required for the relevant purpose. Avoid collecting or using unrelated personal data merely because an exemption may apply to some part of the activity.

Step 5: Review other applicable laws

An exemption under the DPDP Act does not necessarily remove obligations arising under other laws, contracts, confidentiality requirements or sector-specific regulations.

Step 6: Maintain supporting records

Document the purpose of processing, the legal basis relied upon, the relevant approval or notification, the categories of data processed and the reasons for considering the exemption applicable.

Step 7: Reassess when circumstances change

An exemption that may be relevant during litigation, an investigation or a corporate transaction should not automatically be extended to unrelated processing or retained indefinitely without reassessment.

14. Frequently Asked Questions (FAQs)

Q1. What is Section 17 of the DPDP Act, 2023?

Section 17 identifies specific circumstances in which certain provisions, or in some cases the Act as a whole, do not apply to specified personal-data processing activities.

Q2. Can a company rely on Section 17 merely because it is involved in litigation?

No. Under Section 17(1)(a), the processing must be necessary for enforcing a legal right or claim. The existence of litigation does not automatically exempt all data processing by the company.

Q3. Can a law firm rely on Section 17 when handling client information?

The applicable provision must be examined according to the nature and purpose of the processing. A private law firm should not assume that the exemption specifically addressing courts and tribunals automatically covers all its activities. Processing necessary for enforcing a legal right or claim may require a separate assessment under Section 17(1)(a).

Q4. Are startups automatically exempt from the DPDP Act?

No. Section 17(3) provides a mechanism for the Central Government to notify specified Data Fiduciaries or classes of Data Fiduciaries, including startups, for certain exemptions. Eligibility must be assessed against the applicable notification.

Q5. Can a bank disclose a loan defaulter’s personal data freely?

No. Section 17(1)(f) concerns qualifying processing to ascertain the financial information, assets and liabilities of a loan defaulter. It expressly preserves compliance with other applicable laws governing disclosure of information or data.

Q6. Is research automatically exempt from data protection requirements?

No. Section 17(2)(b) requires that the data not be used to make a decision specific to a Data Principal and that the processing comply with prescribed standards.

Q7. Can a private contract exempt a company from the DPDP Act?

No. A contract cannot independently create a statutory exemption. The exemption must arise from the Act and its applicable conditions. Contractual arrangements may allocate responsibilities between parties but cannot, by themselves, remove obligations imposed by law.

Q8. When will Section 17 become applicable?

Under the commencement notification dated 13 November 2025, Section 17 is scheduled to commence on 13 May 2027. The latest official commencement notifications should be checked before applying the provision to a particular matter.

Conclusion

Section 17 of the Digital Personal Data Protection Act, 2023 recognises that certain activities require specific exemptions from ordinary data protection requirements. These include enforcement of legal rights, judicial and regulatory functions, investigation of offences, qualifying overseas contracts, approved corporate restructuring, loan-default assessment, research and specified State activities.

However, these exemptions are purpose-specific and subject to statutory conditions. They should not be treated as unrestricted permission to collect, use, retain or disclose personal information.

For businesses, financial institutions, research organisations and legal professionals, the appropriate approach is to identify the relevant provision, verify its conditions, document the legal basis and consider other applicable laws.

As India’s data protection framework develops, organisations should review their data-handling practices, contractual arrangements and compliance policies in light of the Act, the Rules and their phased commencement.

AgreyaLegal provides legal insights on data protection, privacy compliance, regulatory obligations and emerging technology laws in India. Understanding the statutory framework is an important step towards responsible data handling and effective legal compliance.

Official Legal References

1. Digital Personal Data Protection Act, 2023 — Read the official Act on India Code.
2. Digital Personal Data Protection Rules, 2025 — Read the Rules on India Code.
3. Commencement notification dated 13 November 2025 — Read the Gazette notification.

Disclaimer: This article is intended for general legal information and educational purposes. It is not a substitute for advice on the facts of an individual matter. The commencement status of the relevant provisions and applicable notifications should be verified before taking legal or compliance decisions.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts