Exemptions Under the Act

Section 17 of the DPDPA provides a broad exemptions framework that allows the Central Government to exempt certain categories of processing from some or all provisions of the Act. These exemptions balance individual privacy rights against national security, law enforcement, public interest, and other legitimate state objectives. The breadth of these exemptions has been a subject of significant debate, with critics arguing they give the Government excessive discretionary power.

Section 17(1) provides that certain provisions of the Act shall not apply to processing of personal data in the following categories: 1. Processing necessary for enforcing any legal right or claim 2. Processing by courts, tribunals, or other bodies exercising judicial or quasi-judicial functions 3. Processing for the prevention, detection, investigation, or prosecution of any offence or contravention of any law 4. Processing of personal data of Data Principals not within India, pursuant to a contract with a person outside India 5. Processing necessary for mergers, acquisitions, or corporate restructuring approved by a court or tribunal 6. Processing to identify the financial assets and liabilities of a defaulter under any law These exemptions are purpose-specific - they apply only while the exempt purpose is being served.

Section 17(2) empowers the Central Government, by notification, to exempt any instrumentality of the State from the application of any or all provisions of the Act, if processing is necessary in the interests of: • Sovereignty and integrity of India • Security of the State • Friendly relations with foreign States • Maintenance of public order • Preventing incitement to any cognisable offence relating to these grounds This exemption requires a government notification - agencies cannot self-certify this basis without executive authorisation. It mirrors similar provisions in Article 19(2) of the Constitution. This has been one of the most debated aspects of the DPDPA, as critics argue it could allow government bodies to process personal data with minimal accountability.

Section 17(3) allows the Central Government, by notification, to exempt certain Data Fiduciaries or classes of Data Fiduciaries from certain obligations under the Act. This provision is expected to provide regulatory relief to startups and small enterprises, recognising that the compliance burden may be disproportionate for smaller entities. The scope and conditions of such exemptions will be defined in the notifications issued by the Government.

Section 17(4) addresses processing by the State or its instrumentalities for functions under any law. Where the State processes personal data in the exercise of its sovereign functions, certain provisions of the Act may not apply, ensuring that governmental operations are not impeded. However, even where exemptions apply, the constitutional right to privacy (Puttaswamy) provides a baseline of protection that cannot be wholly overridden.

Processing for research, archiving, or statistical purposes may be exempted, subject to conditions prescribed by the Rules. Rule 16 operationalises this exemption, providing that research institutions may be exempted subject to: • The research serving a demonstrable public interest • Appropriate safeguards being in place (including data minimisation and anonymisation where possible) • The research institution meeting prescribed eligibility criteria • Ethics board approval where applicable This exemption is crucial for academic research, public health studies, and statistical analyses that rely on personal data.