Readiness assessment
The Act
The DPDP Act, explainedNotice · Section 5Consent · Section 6Security · Section 8The DPDP Rules 2025Glossary
Industries
Fintech & BankingHealthcare & PharmaE-commerce & RetailSaaS & TechnologyEdTechGCC & Global CentresBrowse all sectors
Implementation
DPDP implementationFintech & digital lendingDPDP services & partnersVirtual DPOGet certified
Resources
Readiness assessmentGuidesBy roleGlossaryNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this section

Chapter IV · Special Provisions

Section 17: Exemptions

Section 17 is not one blanket exemption but a set of narrow, purpose-specific carve-outs: some automatic, some needing a government notification, and most lifting only particular obligations rather than the whole Act.

Official text
Section 17Exemptions
Chapter
Chapter IV · Special Provisions
Status
Enacted · phased commencement
Full compliance
13 May 2027
Applies to
Data Fiduciaries
Official citation
DPDP Act, 2023, s.17
Reading time
8 min
Updated
August 2026

At a glance

Section 17 is the DPDP Act's exemption framework, and it is not a single corporate exemption. Section 17(1) is a PARTIAL exemption: Chapter II (except the Section 8(1) accountability and 8(5) security duties), Chapter III and Section 16 do not apply to processing necessary for six listed purposes - enforcing a legal claim [17(1)(a)], court, tribunal or regulatory functions [(b)], offence prevention or investigation [(c)], offshore processing of non-India data [(d)], court-approved corporate restructuring [(e)], and loan-default assessment [(f)]. Section 17(2) fully disapplies the Act for notified State instrumentalities [(a)] and for genuine research, archiving or statistics not used for individual decisions [(b)]. Sections 17(3) and 17(5) are notification-based exemptions, including for startups, and 17(4) narrows certain State-processing duties. It is scheduled to take effect on 13 May 2027.

Applies to Data FiduciariesChapter Chapter IVEffective 13 May 2027Read time 8 min

Key takeaways

  • Section 17 is not one blanket exemption: it is several narrow, purpose- and condition-specific carve-outs, each lifting only specified obligations.
  • 17(1) is partial: for six listed purposes it disapplies Chapter II (except the Section 8(1) accountability and 8(5) security duties), Chapter III and Section 16, but you stay accountable and secure.
  • The six 17(1) purposes: legal claim [a], court or regulatory function [b], offence investigation [c], offshore processing of non-India data [d], court-approved merger or restructuring [e], and loan-default assessment [f].
  • 17(2) is a whole-Act exemption but narrow: only notified State instrumentalities [a], and genuine research, archiving or statistics not used for an individual decision [b].
  • 17(3) and 17(5) need a government notification: a startup is not exempt just for being new or small; a notification must name the class and the provisions.
  • "Necessary" is a real threshold: merely helpful or commercially convenient processing does not qualify, and no exemption displaces retention, sectoral or other laws.

Who should read this

Read this if you plan to rely on any DPDP exemption, because Section 17 decides exactly which obligations drop away, for which processing, and which duties always remain.

FoundersLegal / DPOCompliance leadsProduct / engineering

In plain language

Section 17 is the Act's exemptions, and the wrong question is "are we exempt?". The right question is: which processing activity, under which limb of Section 17, is exempt from exactly which obligations, for how long, and what still applies?

Most of it is partial. Section 17(1) covers six specific purposes, like defending a legal claim or a court-approved merger, and even then it keeps your accountability and security duties alive. The broad, whole-Act exemptions in 17(2) are narrow in who can use them: notified State bodies, or genuine research that never drives a decision about a named person.

And several exemptions only exist once the government notifies them. A startup is not automatically exempt under 17(3); a class-wide relief under 17(5) needs a notification naming the class, the provisions and the period. Until then, assume full compliance.

The text of the law

Section 17: Exemptions

17(1) Chapter II (except Sections 8(1) and 8(5)), Chapter III and Section 16 do not apply where processing is necessary for: (a) enforcing a legal right or claim; (b) a court, tribunal or Indian body performing a judicial, quasi-judicial, regulatory or supervisory function; (c) prevention, detection, investigation or prosecution of an offence or contravention; (d) processing of non-India Data Principals' data under a contract with a person outside India by a person based in India; (e) a court-approved compromise, arrangement, merger, amalgamation, demerger or reconstruction; or (f) assessing the financial information, assets and liabilities of a loan defaulter.

17(2) The Act does not apply to (a) processing by a State instrumentality notified in the interest of sovereignty, security, foreign relations, public order or preventing incitement, and Central Government processing of data it furnishes; or (b) processing necessary for research, archiving or statistics that is not used for a decision specific to a Data Principal and follows prescribed standards.

17(3) The Central Government may notify certain Data Fiduciaries or classes, including startups, to whom Sections 5, 8(3), 8(7), 10 and 11 do not apply.

17(4) For processing by the State or its instrumentalities, Sections 8(7) and 12(3) do not apply, and Section 12(2) does not apply where the purpose does not include a decision affecting the Data Principal.

17(5) Before five years from commencement, the Central Government may notify that any provision of the Act does not apply to a Data Fiduciary or class for a specified period.

Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.

What this means for you

  • Treat every exemption as a documented decision, not a status: keep an Exemption Assessment Register recording the activity, the exact 17 limb, the necessity analysis, what is disapplied, what remains, retention and legal sign-off.
  • Under 17(1), keep your accountability and security controls running [8(1), 8(5)]: access control, encryption, processor oversight, logging and purpose-limited retention still apply.
  • For a legal-claim exemption [17(1)(a)], apply a matter-specific legal hold, restrict access to the case team, and do not reuse held data for marketing or profiling.
  • For research [17(2)(b)], prove it is genuine research not used for any individual decision and meet the DPDP Rules 2025 standards; the moment you use it to decide about a named person, the exemption falls away.
  • Do not assume a notification-based exemption (17(3) startup, 17(5) class relief) without an actual Gazette notification that names your class and the provisions.
  • Remember what never drops: retention duties, sectoral regulation, employment and financial-services law, and contracts. Not sure an exemption really applies? Take the readiness assessment or find a specialist.

Frequently asked questions

Can we self-declare a Section 17 exemption?
Only where a directly applicable limb's conditions are genuinely met, such as necessary processing for a legal claim under 17(1)(a). Exemptions under 17(2)(a), 17(3) or 17(5) require a Central Government notification.
If we rely on Section 17(1), can we drop security and privacy controls?
No. Section 17(1) expressly keeps Section 8(1) accountability and 8(5) reasonable security safeguards. Access control, encryption, processor oversight and purpose-limited retention still apply.
Does "research" cover customer analytics, AI training or marketing segmentation?
Not automatically. Section 17(2)(b) needs genuine research, archiving or statistics, no decision specific to a Data Principal, and the DPDP Rules 2025 standards. Profiling and eligibility scoring do not qualify.
Are startups exempt from notice, access or SDF duties?
No. Section 17(3) only lets the Central Government notify certain classes, including startups, for a limited set of provisions (Sections 5, 8(3), 8(7), 10 and 11). No exemption applies without a notification.
Does an M&A deal allow unrestricted sharing of customer data?
No. Section 17(1)(e) covers only processing necessary for a court-approved compromise, arrangement, merger, amalgamation, demerger or reconstruction. Use data minimisation, clean teams, secure data rooms and deletion controls.

Sources

Related sections
Section 16: Transfer of personal data outside IndiaSection 8: Obligations of Data FiduciarySection 7: Certain legitimate usesChapter IV overview

This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.

Start readiness assessment