Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter IV — Special Provisions
DPDP Act, 2023 · Chapter IV of IX

Chapter IV: Special Provisions

Chapter IV deals with two things that cut across the rest of the Act: sending personal data outside India, and the situations in which parts of the Act do not apply.

Sections 16–17 · 2 sectionsAll 2 sections effective 13 May 2027Reviewed September 2026
Back to the Full DPDP Act GuideChapter V — Data Protection Board of India
  1. 16Processing of Personal Data Outside India
  2. 17Exemptions

Chapter summary

In plain terms: Section 16 lets the Central Government restrict the transfer of personal data to specified countries by notification — everything else is permitted by default — and preserves stricter sector laws. Section 17 lists exemptions: enforcing legal rights, courts and tribunals, preventing and investigating offences, certain outsourced processing for foreign Data Principals, research and statistical use, and notified State instrumentalities and Data Fiduciary classes such as start-ups.

How the sections fit together

Chapter IV is short, but it reshapes how the rest of the Act applies. Section 16 is about geography: personal data can move abroad freely unless the Central Government restricts a particular country, and stricter sector laws still win. Section 17 is about scope: it lists situations in which rights, duties or the whole Act do not apply, from court proceedings to research and certain start-ups.

Read the two together. Section 16 tells you where your data may go. Section 17 tells you which obligations you can set aside for a given processing activity, and which ones stay.

Sections at a glance

Sections 16–17 of the DPDP Act, 2023. Select a section to open its own page, with the full explanation, a worked example and common questions.

Sec. 16Processing of Personal Data Outside IndiaEffective 13 May 2027

Section 16 gives the Central Government a targeted tool to restrict cross-border data transfers to specific countries or territories, while making clear it doesn't override stricter transfer rules that already exist in other Indian laws.

Read the full explanation Sec. 17ExemptionsEffective 13 May 2027

Section 17 is where the Act carves out entire categories of processing from most of Chapter II and III's obligations — legal enforcement, courts and tribunals, crime prevention, cross-border contracts, corporate restructuring, research, national security, and small or early-stage businesses like startups.

Read the full explanation

Key terms in this chapter

Negative list
The approach in Section 16 where transfers are allowed by default and the Central Government names the countries or territories to which transfer is restricted.
Exemption
A provision under which chapters II, III or other parts of the Act do not apply to a specified activity or class of entity.
Notified instrumentality of the State
A State body the Central Government notifies for exemption in the interest of security of the State, sovereignty, public order or relations with foreign States.
Class of Data Fiduciary
A group of fiduciaries, such as start-ups, that the Central Government may exempt from specified provisions based on volume and nature of processing.
Research, archiving and statistical purposes
A purpose for which processing can be exempt when personal data is not used to take any decision specific to a Data Principal and standards in the Rules are followed.

Why this chapter matters

Cross-border data flows and exemptions decide how heavy a DPDP programme will be for many businesses. The default-open approach to transfers matters for cloud, SaaS and global operations, while the Section 17 exemptions determine which obligations an organisation can safely relax, and which of them (such as security safeguards) always remain.

Who needs to care about this chapter

  • Cloud, SaaS and IT-services companies that move or host data across borders.
  • Outsourcing firms processing data of people outside India under contract.
  • Start-ups and research bodies checking whether a class exemption could apply.
  • Banks, insurers and other regulated entities whose sector rules on data localisation may be stricter.

Compliance checklist

Practical steps that follow from this chapter. Treat it as a starting point and adapt it to your sector and systems.

  • Map every cross-border data flow, including cloud regions, support teams and sub-processors.
  • Monitor notifications for restricted countries and review vendor locations against them.
  • Check sector regulators for localisation or stricter transfer rules in your industry.
  • If relying on an exemption, record the clause, the facts and the date, and keep security safeguards in place.
  • If you process data of people outside India under a contract with a foreign party, check whether that exemption fits.
  • Watch for notifications that exempt classes of fiduciaries, including start-ups.

Common mistakes to avoid

  • Assuming the Act bans transfers abroad.
  • Forgetting that another law requiring local storage or stricter handling still applies.
  • Treating an exemption as total. Duties such as security safeguards generally continue.
  • Assuming a start-up is exempt before the Central Government has notified the class.

Related DPDP Rules

The Act sets the framework and the DPDP Rules, 2025 supply the operational detail. These Rules work with this chapter.

Rule 15 — Cross-Border Transfer

Read the Rule

Rule 16 — Research, Archiving and Statistical Exemption

Read the Rule

Rule 12 — Exemptions for Children's Data

Read the Rule

Common questions

Does the DPDP Act ban transferring data outside India?
No. Transfers are allowed unless the Central Government restricts a particular country or territory by notification. Where another law requires stricter handling or localisation, that law continues to apply.
Are start-ups exempt from the Act?
Not automatically. Section 17 allows the Central Government to notify classes of Data Fiduciaries, including start-ups, as exempt from specified provisions such as certain notice and erasure duties, having regard to volume and nature of processing.
Which obligations does an exemption never remove?
Even where Section 17 exempts a processing activity from most provisions, the duty to keep reasonable security safeguards and to report personal data breaches generally remains. Read Section 17 itself for the exact carve-outs.
Can a company use servers outside India?
Yes, unless the Central Government has restricted transfer to that country, and unless a sector law requires the data to stay in India.
Are government agencies exempt from the DPDP Act?
Section 17 allows the Central Government to exempt notified instrumentalities of the State, for specified grounds such as security of the State and public order. The exemption is by notification and is not automatic.
Does research get a blanket exemption?
Section 17 exempts processing for research, archiving or statistical purposes where the data is not used to make decisions specific to a Data Principal and the standards in the Rules are met.
Do we need government approval before transferring personal data to any country outside India?
Not under this section by itself - Section 16 works by restricting transfers only to specifically notified countries or territories, rather than requiring approval for every international transfer.
If a sector-specific law requires us to keep certain data only in India, does Section 16 override that?
No - sub-section (2) explicitly preserves any other law that imposes a higher degree of protection or a stricter transfer restriction; Section 16 doesn't loosen sector-specific data-localisation requirements.
If we're exempt under sub-section (1), does that mean none of the Act applies to us at all?
No - the exemption is scoped to specific processing necessary for the listed purpose, and even then, Section 8(1) (accountability) and Section 8(5) (security safeguards) continue to apply. It isn't a full exit from the Act.
Are all startups automatically exempt from some DPDP obligations?
No - sub-section (3) requires a specific Central Government notification naming the exempt Fiduciaries or classes (which can include startups, defined per the government's own startup-recognition criteria); it isn't a self-executing exemption available to any business that calls itself a startup.

Related pages

Chapter V — Data Protection Board of India

The next chapter of the Act.

Read Chapter V

Chapter III — Rights and Duties of Data Principal

The previous chapter of the Act.

Read Chapter III

Full DPDP Act Guide

All 44 sections of the Act, grouped by chapter, with status.

View all chapters

DPDP Compliance

Where cross-border and exemption questions fit into a compliance programme.

See the compliance hub