Start-up Exemption
The Government’s power to relieve notified classes of fiduciary, including start-ups, of certain duties.
The start-up exemption is a power given to the Government to relieve start-ups and other notified classes of some duties under the Act. It does not apply automatically; it depends on a notification.
Meaning of Start-up Exemption
Section 17(3) allows the Central Government to notify classes of Data Fiduciary, including start-ups, to which provisions on notice, accuracy, erasure, Significant Data Fiduciary duties and the right to access information will not apply. It depends on the volume and nature of the data. There is no automatic start-up exemption.
Section 17(3) allows the Central Government, having regard to the volume and nature of personal data processed, to notify certain Data Fiduciaries or classes of Data Fiduciaries, including start-ups, as exempt from specified provisions. The provisions that can be lifted are the notice requirements, certain erasure duties, the additional duties of a Significant Data Fiduciary under Section 10 and the right to access information under Section 11. An Explanation to the section links the word start-up to the criteria and process used by the department that administers start-up recognition.
The word to focus on is "notify". The sub-section creates a power, not a status. A company is not exempt because it has an office in a co-working space, uses the label start-up or has a Startup India registration. Relief arises only if a notification covers the class to which it belongs, and then only from the provisions named in that notification. Until a notification is issued, a start-up has the same obligations as any other fiduciary.
What is not on the list matters even more. Section 17(3) does not allow relief from the duty to obtain valid consent or to rely on a legitimate use, from the duty to take reasonable security safeguards, from breach intimation, or from the rules on children's data. A start-up holding sensitive health or financial data would therefore still face the highest penalty ceilings, up to ₹250 crore for safeguards and up to ₹200 crore for failing to notify a breach, even if it were relieved of notice and access duties.
The exemption should also be distinguished from others. Section 17(5) allows time-limited exemption of any fiduciary from any provision within five years of the Act's commencement, a separate and broader transitional power. The research exemption in Section 17(2)(b) depends on the purpose, not the size. And Section 17(1) exemptions turn on the activity. The start-up exemption turns on the class of fiduciary and the volume and nature of data, which is why a small company processing a lot of intimate data may not benefit.
Examples of Start-up Exemption
A small start-up checks the gazette each quarter in case it falls within a notified class.
A fintech start-up with a few thousand users assumes it is exempt. Its counsel checks the Gazette and finds no notification covering the company, so it implements notice, consent and security as required and keeps the notice module flexible.
An ed-tech start-up serving children finds that, even if a start-up notification were issued, it could not lift the duties on children's data under Section 9. It invests early in parental consent and avoids behavioural tracking.
A health-tech start-up is notified within a class relieved of notice duties. It still reviews its [encryption](term/encryption), access logging and breach plan, since those duties are untouched and the data it holds is intimate.
Why Start-up Exemption matters
Start-ups often have the smallest compliance budgets and the largest exposure, because they handle data at scale through cloud services and third-party tools. A founder who plans on the basis of an exemption that has not been notified may build a product without notice or access tooling and then face expensive re-engineering later. Investors and acquirers also review data protection compliance in due diligence, so a gap can affect funding.
On the other hand, if a notification is issued, a start-up that has not tracked it may spend resources on duties it no longer has. The right approach is to build the core controls that will never be exempt, security, consent and breach response, and to treat notice and access tooling as modular so it can be scaled up or down.
How it works in practice
- 1Check the Gazette and MeitY announcements for notifications under Section 17(3), and note whether the notification names your class of fiduciary, the duties lifted, any conditions and the effective date.
- 2Build the non-exempt basics first: a documented consent flow, a short list of vendors with processor contracts, role-based access control, encryption and a one-page breach plan that follows Rule 7.
- 3Design notice and rights features as configurable modules. If a notification later lifts the duty, you can simplify; if not, the feature is already in place.
- 4Ask your lawyer to confirm whether your product's data volume and nature could take you outside any notified class, for example if you scale quickly or process financial or health information.
- 5Record in your compliance register the legal basis for any duty you have decided not to implement, with the notification number and date, so a reviewer can verify it.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming every start-up is exempt. There is no automatic exemption; a notification is needed.
Thinking an exemption covers security. Reasonable safeguards and breach reporting are not among the duties that Section 17(3) can lift.
Using start-up recognition as proof of exemption. Recognition is only one factor in how a class is defined.
Stopping all compliance work in the hope of an exemption. You may then be unable to catch up by 13 May 2027.
Compliance tips
Plan for the strictest scenario and simplify later if a notification arrives.
Keep evidence of your data volumes over time, since the volume and nature of data are the stated criteria.
Use standard processor contracts early; they are cheap to adopt and often requested by enterprise customers.
Join an industry body that tracks notifications and comments on draft ones.
Common questions about Start-up Exemption
Are start-ups exempt from the DPDP Act?
Not automatically. Section 17(3) lets the Central Government notify classes of fiduciary, including start-ups, who are relieved from certain duties such as notice and the right to access information. Until a notification applies to your class, the full Act applies.
Which duties can the start-up exemption lift?
The sub-section refers to notice, certain erasure duties, Significant Data Fiduciary obligations and the right to access information. It does not lift security safeguards, breach intimation or the children's data rules.
How is a start-up defined for this exemption?
The Act's Explanation refers to the criteria and process the department administering start-up recognition uses, so recognition criteria matter. The exact class covered would be set out in the notification itself.