Section 17

Exemptions

Lists where most of the Act is switched off, including legal claims, regulatory functions, offshore contracts and research.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1): Chapter II other than s.8(1) and s.8(5), Chapter III, and s.16 do not apply where processing is necessary for enforcing a legal right or claim, for judicial, quasi-judicial, regulatory or supervisory functions, for the prevention, detection, investigation or prosecution of offences, for processing the data of non-Indian Data Principals under a contract with a person outside India, for a court-approved merger, amalgamation or reconstruction, or for ascertaining the financial information and assets of a loan defaulter.
(2): The Act does not apply to processing by a notified instrumentality of the State in the interest of sovereignty, security or public order, or to processing necessary for research, archiving or statistical purposes where it is not used to take decisions specific to a Data Principal and follows the prescribed standards.
(3): The Central Government may notify Data Fiduciaries or classes of them, including startups, to whom s.5, s.8(3), s.8(7), s.10 and s.11 will not apply.
(4): For State processing, s.8(7) and s.12(3), and in certain cases s.12(2), do not apply.
(5): Within five years of commencement, the Central Government may declare any provision inapplicable to specified Data Fiduciaries for a specified period.

In practice

The exemption in sub-section (1) is deliberately partial, and the two obligations it never switches off are the two that matter most: s.8(1) accountability and s.8(5) security safeguards. Even a fully exempt processing activity still has to be secured, and the fiduciary still answers for it. The startup relief in sub-section (3) is also conditional on a notification, so it is not something a company can simply claim.

s.8General obligations of Data FiduciaryThe operational core of the Act: accountability for processors, accuracy, security safeguards, breach intimation, erasure, published contact details and grievance redressal.s.16Processing of personal data outside IndiaLets the Central Government restrict transfers of personal data to notified countries, and preserves stricter transfer rules found in other laws.Rule 16Exemption for research, archiving and statistical purposesDisapplies the Act to research, archiving and statistical processing carried on in line with the Second Schedule standards.Sch. IIStandards for State processing and for the research exemptionThe seven standards that State processing under Section 7(b) and exempt research processing must both meet.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 17 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next