Section 17 — Exemptions

What this section requires

Section 17 exempts specific processing from most of Chapters II and III. The Chapter II/III exemptions (sub-section (1)) cover: enforcing a legal right or claim; processing by a court, tribunal, or a body performing a judicial, quasi-judicial, regulatory or supervisory function; processing for preventing, detecting, investigating or prosecuting an offence; contract-based processing of non-Indian Data Principals' data by an India-based party; processing necessary for a court-approved merger, demerger or corporate restructuring; and processing to ascertain a loan defaulter's financial position. Sections 8(1) and 8(5) still apply even to these — accountability and security safeguards aren't exempted.

A second set (sub-section (2)) exempts the whole Act for processing by specific State instrumentalities the government notifies (on sovereignty, security, public order or foreign-relations grounds), and for research, archiving or statistical processing that doesn't feed a decision about a specific Data Principal and follows prescribed standards.

A third set (sub-section (3)) lets the government exempt notified Data Fiduciaries or classes — including startups — from Section 5 (notice), Section 8(3) and 8(7) (accuracy and erasure), and Sections 10 and 11 (SDF duties and the access right).

A fourth (sub-section (4)) exempts State processing from Section 8(7) (erasure) and, where the processing doesn't feed a Data Principal-specific decision, from Section 12(2)-(3) (correction and erasure rights).

A fifth (sub-section (5)) lets the government exempt any Data Fiduciary or class from any Act provision entirely, for a specified period, by notification issued before the Act's fifth anniversary.

Who it applies to

Only the specific processing activities, State instrumentalities, or notified Data Fiduciaries each sub-section names — this is a set of narrow, purpose-bound carve-outs, not a general compliance opt-out.

Checklist

• Don't assume any exemption applies without checking which specific sub-section and clause your processing actually fits — the drafting is deliberately narrow.
• Remember Sections 8(1) and 8(5) survive every sub-section (1) exemption — accountability and security safeguards are never waived by this section.
• For the startup/notified-class exemption under sub-section (3), confirm the Central Government has actually notified your organisation or class — it is not self-declared.
• For research/archiving/statistical processing, confirm the processing genuinely doesn't feed a decision specific to an individual and meets the standards Rule 16 sets once in force — the exemption is purpose-conditioned, not sector-wide.

Penalty exposure

Not applicable in the ordinary sense — Section 17 removes obligations rather than creating one. Relying on an exemption that doesn't actually apply exposes the underlying, un-exempted obligation to its normal Schedule penalty.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).