Research, Archiving and Statistical Exemption
An exemption for processing needed for research, archiving or statistics, if done to the standards in the Second Schedule.
The research exemption lets organisations process personal data for research, archiving or statistics without following the usual Act duties, as long as they meet set standards and do not use the data to make decisions about a particular person.
Meaning of Research, Archiving and Statistical Exemption
The processing must be necessary for that purpose, must not be used to take decisions specific to a Data Principal and must follow the Second Schedule standards: lawful use, limited purpose, minimum data, accuracy, limited retention and security. Calling something "research" is not enough.
Section 17(2)(b) says the Act does not apply to processing of personal data necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with the standards specified in the Rules. Rule 16 gives effect to this, and it refers to the Second Schedule, which is also used for State processing under Rule 5.
There are three tests packed into this exemption. First, the processing must be necessary for the research, archiving or statistical purpose; calling something research does not make it so. Second, the data must not be used for a decision specific to an individual, so a study of loan default patterns is acceptable, but using the same data to deny a particular applicant credit is not. Third, the processing must follow the Second Schedule standards: lawful use, a limited and stated purpose, collection and retention only as needed, reasonable accuracy, limited retention, and reasonable security safeguards.
The effect is that notice, consent, rights and several Chapter II duties do not apply to that processing, because researchers working with large datasets cannot reasonably seek fresh consent from every person. But the Second Schedule is still a real standard. It carries many of the same principles that the Act applies elsewhere, so a researcher gets relief from the individual-facing steps while still treating data responsibly. It also means the data is better protected if it is de-identified, aggregated or pseudonymised before analysis, since that reduces the chance of a decision about an individual.
Related ideas should be kept apart. This exemption is different from the general exemptions in Section 17(1), which cover legal claims and similar matters, and from the start-up relief in Section 17(3). It is also different from consent given for a research purpose, which remains an available ground for processing under Sections 4 and 6. A company can use either route, but if it relies on the exemption it must be able to show the three tests were met, because the person relying on an exemption should expect to explain it if questioned.
Examples of Research, Archiving and Statistical Exemption
A university uses anonymised health survey data for a statistical study that meets the standards.
A university team studies diabetes trends using de-identified hospital records, reports only district-level results and deletes the working file when the study ends. It documents necessity, no individual decisions and the Second Schedule steps.
A pharmaceutical company uses historic trial data to build a statistical model of adverse reactions. Because the output is a model and not decisions about named participants, it treats the work as statistical processing but keeps strong access controls.
An insurer wants to call a pricing project "research" but plans to use the same dataset to re-price named policyholders. The compliance lead concludes this would be a decision specific to Data Principals, so the exemption does not apply and consent or another ground is needed.
Why Research, Archiving and Statistical Exemption matters
Research and statistics are important in public health, education policy, economics and social science, and the exemption exists so that these are not blocked by consent rules that do not fit large datasets. Yet the exemption is also tempting to misuse. A business that relabels customer profiling as a "research project" and then uses results to target individuals would fail the second test and lose the exemption, leaving it exposed to the Act's full penalty range for breaches of notice, consent and security.
The institutional stakes are significant. Universities, hospitals, pharmaceutical firms and statistical agencies depend on data from many sources. A written, repeatable approach to the exemption protects research funding and publication, as grant makers and journals increasingly ask about data protection compliance.
How it works in practice
- 1Write a research protocol that states the purpose, the data needed, the source, the retention period, who has access and the expected outputs. This protocol is the central evidence that the processing is necessary and limited.
- 2Remove identifiers as early as possible. Use pseudonymised or aggregated data where the research question allows it, and keep any key that can re-link data separate and access-controlled.
- 3Put a firewall between research and decision-making. Record that results are reported at group level and that no staff member can use the dataset to decide something about a named individual.
- 4Apply the Second Schedule standards: keep only what is needed, check accuracy to a reasonable degree, set a deletion or archival date, and apply encryption and access logs as part of reasonable security safeguards.
- 5Review the protocol with an ethics committee or compliance lead, and record changes. If the project changes so that individual-level decisions are needed, stop relying on the exemption and obtain consent.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Using the word research as a label. The processing must actually be necessary for research, archiving or statistics.
Using the data later for decisions about individuals. That breaks the second condition and ends the exemption.
Ignoring the Second Schedule standards. The exemption does not remove the Act entirely.
Keeping data for ever "in case it is useful". Retention must be limited.
Compliance tips
Keep a one-page exemption memo for each project, signed by the lead investigator and compliance contact.
Where individual follow-up is needed, such as inviting a participant to a second study, obtain consent for that step separately.
Share datasets with other institutions only under written terms that repeat the limits.
Review the position when the Rules or the Second Schedule are amended.
Common questions about Research, Archiving and Statistical Exemption
Does the DPDP Act exempt research?
Yes, partly. Section 17(2)(b) excludes processing necessary for research, archiving or statistical purposes if the data is not used to decide anything about a specific Data Principal and the Second Schedule standards are followed, as Rule 16 provides.
Can a company call its marketing analysis research to use this exemption?
Not safely. The processing must be necessary for genuine research or statistics, and the data must not be used for decisions specific to individuals. Targeting named customers fails that condition.
Do researchers still need to protect the data?
Yes. The Second Schedule requires lawful processing, limited purpose, minimum data, reasonable accuracy, limited retention and reasonable security safeguards even where the exemption applies.