Exemptions (Section 17)
Situations where some or all of the Act’s duties do not apply.
An exemption is a situation in which some or all of the DPDP Act's duties do not apply. Section 17 lists these situations, and each is limited to what is necessary for its purpose.
Meaning of Exemptions (Section 17)
Section 17 exempts, from most obligations and rights, processing for enforcing legal rights, court functions, preventing and detecting offences, certain processing of non-residents' data under foreign contracts, approved mergers and tracing assets of defaulters by financial institutions. It also lets the Government exempt State bodies for security and public order, and covers research, archiving and statistics. A notified class, including start-ups, can be relieved of certain duties.
Section 17 is the main exemptions provision. Sub-section (1) lists six situations in which the Act's obligations on Data Fiduciaries in Chapter II (except Section 8(1) and Section 8(5)), the rights in Chapter III and the restriction on transfer in Section 16 do not apply: processing necessary to enforce a legal right or claim; processing by a court, tribunal or body performing judicial, quasi-judicial, regulatory or supervisory functions; processing to prevent, detect, investigate or prosecute offences; processing of personal data of Data Principals outside India under a contract with a person in India; processing under an approved scheme of merger, demerger or similar arrangement; and processing to ascertain the financial information and assets of a loan defaulter by a financial institution.
Two sections stay in force even under Section 17(1): Section 8(1), under which the fiduciary remains responsible for complying with the Act, and Section 8(5), the duty to take reasonable security safeguards. This keeps data secure even where the consent and notice rules fall away. Each exemption also depends on necessity; a court is exempt only for its judicial functions, and a party relying on a legal claim cannot use that to cover unrelated marketing.
Sub-section (2) goes further and takes certain processing outside the Act altogether. One part covers instrumentalities of the State that the Central Government notifies in the interests of sovereignty, security of the State, friendly relations with foreign States or public order. The other covers processing for research, archiving or statistical purposes, provided the data is not used to take any decision specific to a Data Principal and the processing follows the standards prescribed in the Rules (Rule 16 with the Second Schedule).
Sub-section (3) allows the Central Government to notify classes of fiduciary, including start-ups, who are relieved from certain duties, based on the volume and nature of data processed. Sub-section (4) gives State processing limited relief from erasure and correction duties. Sub-section (5) allows time-limited exemption of any fiduciary or class from any provision of the Act, but only within five years of commencement. Separately, Rule 12 and the Fourth Schedule relieve certain classes and purposes from the verifiable parental consent and tracking rules for children's data.
Examples of Exemptions (Section 17)
A bank checks whether tracing the assets of a loan defaulter falls within the Section 17 exemption.
A bank traces the assets of a borrower who has defaulted on a loan. It treats this as an exempt activity under Section 17(1) for financial institutions, limits the data used to what is necessary, and still keeps [encryption](term/encryption) and access controls in place.
An Indian services company processes data of European customers' end users under a contract with a foreign client. It reviews the contract-based exemption for data of Data Principals outside India, and keeps documents to show the data does not relate to people in India.
Two retail groups merge under a court-approved scheme and need to combine customer databases. The legal team documents that the processing is within the scheme and does not use the combined data for fresh marketing without consent.
Why Exemptions (Section 17) matters
Exemptions are among the most misunderstood parts of any privacy law. Organisations often assume a general label, such as "we are a regulated entity" or "this is a legal matter", is enough. It is not. Each exemption depends on its words and on necessity, and relying on one wrongly leaves the organisation exposed to the full penalty range, including ₹250 crore for failing to take reasonable safeguards, which stays applicable in most cases.
For individuals, exemptions explain why a bank may refuse to erase certain records, or why a court is not required to seek consent from litigants. Understanding the scope helps a Data Principal decide which complaints are likely to succeed and which concern processing the Act expressly leaves outside its normal duties.
How it works in practice
- 1List every processing activity and mark whether any Section 17 exemption might apply. Do this at activity level, not company level, because the same company may have both exempt and non-exempt processing.
- 2For each claimed exemption, write a short note quoting the clause, describing the facts that bring the activity within it, and explaining why the processing is necessary for that purpose.
- 3Keep security safeguards in place for exempt processing, since Section 8(5) continues to apply, and confirm that the processor contracts still require them.
- 4Separate exempt data from other data in your systems, with its own retention and access rules, so that an exemption for one purpose does not leak into marketing or analytics.
- 5Review exemptions each time a notification is issued, as sub-section (3) classes, State exemptions and time-limited exemptions under sub-section (5) can change the position.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating an exemption as a blanket pass. Each is limited by its wording and by necessity.
Forgetting that Section 8(1) and 8(5) keep applying. Exempt data still has to be protected.
Assuming start-ups are exempt automatically. That depends on a notification under Section 17(3).
Using the exemption for a different purpose later. Data processed for a legal claim cannot be reused for promotions.
Compliance tips
Keep a register of exemptions relied on, each with a named approver and a review date.
Ask counsel to confirm any exemption before it supports a high-value or high-risk activity.
Do not tell customers that the Act does not apply to you unless an exemption clearly covers that processing.
Re-check sector rules, since regulators such as RBI and SEBI may impose their own duties regardless of the DPDP exemption.
Common questions about Exemptions (Section 17)
What are the exemptions under Section 17 of the DPDP Act?
They include processing for enforcing legal claims, judicial and regulatory functions, preventing and investigating offences, certain contracts involving data of people outside India, approved mergers and loan-default asset tracing, plus State, research and notified-class exemptions.
If an exemption applies, do I still need security safeguards?
Yes. Under Section 17(1), Section 8(1) and Section 8(5) continue to apply, so the fiduciary stays responsible for compliance and for reasonable security safeguards even where other duties fall away.
Is the DPDP Act applicable to the government?
Yes, but with exemptions. State instrumentalities can be notified for exemption in the interests of security, sovereignty or public order, and State processing has limited relief from some erasure and correction duties. Other State processing remains covered.