Section 17: Exemptions

Quick summary

What Section 17 says

• Sub-section (1) — the provisions of Chapter II (except Section 8(1) and (5)), Chapter III, and Section 16 don't apply in the six situations below.
• Clause (1)(a) — processing is necessary for enforcing any legal right or claim.
• Clause (1)(b) — processing is by a court, tribunal or other body entrusted by law with a judicial, quasi-judicial, regulatory or supervisory function, where necessary for that function.
• Clause (1)(c) — processing is in the interest of prevention, detection, investigation or prosecution of any offence or contravention of law.
• Clause (1)(d) — personal data of Data Principals not within India's territory is processed pursuant to a contract with any person outside India by a person based in India.
• Clause (1)(e) — processing is necessary for a scheme of compromise, arrangement, merger, demerger, reconstruction or transfer of undertakings, approved by a court, tribunal or other competent authority.
• Clause (1)(f) — processing is for ascertaining the financial information and assets/liabilities of a person who has defaulted on a loan from a financial institution.
• Sub-section (2)(a) — the Act doesn't apply to processing by a State instrumentality the Central Government notifies, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintaining public order, or preventing incitement to any cognizable offence, and processing by the Central Government of any personal data such instrumentality furnishes to it.
• Sub-section (2)(b) — the Act doesn't apply to processing necessary for research, archiving or statistical purposes, if the data isn't used to make a decision specific to a Data Principal and the processing follows prescribed standards.
• Sub-section (3) — having regard to the volume and nature of personal data processed, the Central Government may notify certain Data Fiduciaries or classes, including startups, as exempt from Section 5 (notice), Section 8(3) and (7), and Sections 10 and 11.
• Sub-section (4) — in respect of processing by the State or its instrumentalities, Section 8(7) and Section 12(3) don't apply, and where the purpose doesn't include making a decision affecting the Data Principal, Section 12(2) doesn't apply either.
• Sub-section (5) — the Central Government may, before the expiry of five years from the Act's commencement, by notification declare that any provision of the Act doesn't apply to a specified Data Fiduciary or class, for a specified period.

Breaking it down

Section 17 works in five tiers, from narrow to broad:

• Sub-s. (1)

  Partial

  Six situations skip most of Chapters II and III and Section 16. Sections 8(1) and 8(5) still apply.

• Sub-s. (2)

  Full

  Notified State security processing, and qualifying research, archiving or statistical use, fall outside the Act.

• Sub-s. (3)

  By class

  Notified Fiduciaries or classes, including start-ups, skip five named provisions.

• Sub-s. (4)

  State processing

  Narrower carve-outs from erasure and correction duties, tied to purpose.

• Sub-s. (5)

  Time-limited

  Any provision, for a specified period, if declared within five years of commencement.

Sub-section (1)'s six exemptions are scoped, not blanket. Each applies only “where necessary” for its specific purpose — a court doesn't get a general exemption from data-protection obligations, only for processing necessary to its judicial function; a legal-claim exemption doesn't cover unrelated processing by the same organisation. Notice, in particular, two sub-sections of Section 8 remain binding even under this exemption: 8(1) (accountability for the Fiduciary's own compliance) and 8(5) (reasonable security safeguards) keep applying regardless.

The Act's own illustration for clause (f) makes the loan-default exemption concrete. A bank ascertaining a defaulting borrower's financial information and assets/liabilities to recover a loan doesn't need to run that specific processing through the full Chapter II/III framework — “default” and “financial institution” here carry the same meanings as under the Insolvency and Bankruptcy Code, 2016.

Sub-section (2) is a full carve-out from the Act, not just from Chapters II/III. Unlike sub-section (1)'s partial exemption, sub-section (2)(a)'s specifically notified national-security-related State processing, and sub-section (2)(b)'s properly-anonymised-outcome research/archiving/statistical processing, fall outside the Act entirely for that processing.

Startups get a named, but not automatic, route to lighter obligations. Sub-section (3) lets the Central Government exempt startups (and other notified classes, based on data volume/nature) from five specific obligations — notice, purpose-lapse erasure and Data-Processor erasure duties, Significant Data Fiduciary obligations, and the right to access information. This isn't self-certifying: it requires the Central Government's notification, and the Act's own explanation defines “startup” by reference to the criteria and process the department administering startup recognition uses.

Government processing gets its own narrower carve-outs under sub-section (4), tied to purpose. State processing is exempted from the erasure-on-purpose-lapse duty and from the Data Principal's active erasure-request right, and — specifically where the processing isn't for a decision affecting the individual — from the correction/completion/updating obligation too.

Sub-section (5) is a time-limited, broader safety valve. Unlike the other sub-sections' fixed exemptions, this lets the Central Government exempt any Fiduciary or class from any Act provision, for a specified period, but only if the declaration is made within five years of the Act's commencement — a transitional flexibility tool, not a permanent standing power.

Why this section matters

Section 17 is what stops the Act's obligations from creating absurd or counterproductive results in specific contexts — a court unable to process evidence, a bank unable to pursue a defaulting borrower's assets, academic researchers unable to work with anonymised datasets, or an early-stage startup facing the same compliance burden as a large enterprise. It's also one of the sections most worth re-checking periodically, since sub-sections (3) and (5) both depend on government notifications that can change which organisations and provisions are actually exempted.

Real-world example

Who needs to care about this section

• Legal, compliance and litigation-support teams — sub-section (1)'s legal-claim, court/tribunal and law-enforcement exemptions are directly relevant to how litigation and regulatory-response data is handled.
• Financial institutions handling loan recovery — sub-section (1)(f) is a specific, named exemption for exactly this activity.
• Academic and research institutions — sub-section (2)(b)'s research/archiving/statistical exemption depends on genuinely not using data for individual-specific decisions and following prescribed standards.
• Startups and small Data Fiduciaries — should track whether they fall within a sub-section (3) notification, which can meaningfully lighten their compliance load.

Common questions

Related sections