Rule 16: Exemption From Act for Research, Archiving or Statistical Purposes
Rule 16 gives researchers, archivists and statisticians room to work — but only if that processing follows the same Second Schedule standard used elsewhere in the Rules.
Quick summary
What Rule 16 says
- The Act's provisions don't apply to processing of personal data necessary for research, archiving or statistical purposes, if carried on in accordance with the standards specified in the Second Schedule.
Breaking it down
This is a conditional exemption, not an unconditional one — the condition is doing most of the work:
“Necessary” sets a real bar. The exemption covers processing that's actually necessary for the research, archiving or statistical purpose — not any processing an organisation happens to label as research.
The Second Schedule standard still applies in full. This is the same standard Rule 5 applies to government processing: lawful processing, purpose limitation, data minimisation, reasonable accuracy efforts, retention limits, and reasonable security safeguards. A researcher doesn't get a free pass on data protection generally — they get relief specifically from the Act's individual-facing obligations (like consent and notice) while still having to meet this baseline standard.
This is what lets statistical and archival institutions function. Census-style statistical work, academic research, and archival preservation projects would often be impossible if every data point required fresh, individual consent. Rule 16 is the mechanism that makes that kind of large-scale, aggregate-purpose processing legally workable.
Why this rule matters
Without an exemption like this, legitimate research — public health studies, academic social-science research, national statistical surveys — could be effectively blocked by consent requirements that don't fit how research at scale actually works. Rule 16 preserves that ability while still insisting on baseline data-protection discipline.
Real-world example
Who needs to care about this rule
- Academic and public-health researchers working with personal data at scale.
- Archival institutions preserving historical records that include personal data.
- Government and private statistical bodies conducting surveys and aggregate analysis.
Common questions
Does this exemption apply to any processing an organisation calls ‘research’?
Does the Second Schedule mean researchers still need security safeguards?
Is this the same Schedule referenced by Rule 5?
Related rules
Rule 15 — Transfer of Personal Data Outside the Territory of India
Read the previous rule in sequence.
Read Rule 15Rule 17 — Appointment of Chairperson and Other Members
Continue to the next rule in sequence.
Read Rule 17Full DPDP Rules Guide
Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.
View all 23 rules