Research Exemption (R.16)

Rule 16 specifically provides an exemption for processing of personal data by research institutions, subject to the conditional exemption mentioned in Section 17(2)(b) of the Act. The exemption applies where: 1. Processing is for research, archival, or statistical purposes 2. The personal data is not used for any decision specific to a Data Principal - the 'Non-Individual Decision' rule. If the data is used to impact a specific person (e.g., medical diagnosis or credit scoring), the exemption is immediately voided. 3. The processing is carried out in accordance with the standards set out in the Second Schedule to the Rules This creates a limited carve-out for legitimate research activities while ensuring the exemption cannot be used to circumvent Data Principal protections for commercial purposes. It operationalises Section 17 exemptions under the Act.

The research exemption is subject to important conditions: • No individual decisions: The exemption only applies where the data is used for aggregate research, statistical analysis, or archival purposes - not for making decisions about specific individuals. • Second Schedule safeguards: Research institutions must implement the standards set out in the Second Schedule to the Rules. • Institutional context: While the Rules use the term 'research institutions,' the underlying Section 17(2)(b) refers to the purpose of the processing. Commercial entities must be extremely careful: if research is a 'secondary activity' used to drive product development (commercial purpose), the exemption likely will not apply. • Purpose limitation: The exemption does not authorise processing for purposes beyond research, archival, or statistics - repurposing research data for commercial applications would exceed the exemption's scope.

The Second Schedule to the Rules sets out the standards that must be met for the Section 17(2)(b) research, archival and statistical exemption (and, separately, for Rule 5 State processing under Section 7(b)). Appropriate technical and organisational measures must ensure: (a) the processing is lawful; (b) the processing is for the permitted research, archival or statistical purposes; (c) the processing is limited to personal data necessary for those purposes; (d) reasonable efforts are made to ensure the completeness, accuracy and consistency of personal data; (e) personal data is retained only for as long as required for those purposes, or for compliance with law; (f) reasonable security safeguards are taken to prevent personal data breach, including where a Data Processor is engaged; (g) for State processing under Section 7(b), an intimation is given to the Data Principal covering the business contact information of a person who can answer questions about the processing, the communication link and means to exercise rights, and consistency with other applicable Central Government policy or law; and (h) accountability rests with the person who determines the purpose and means of the processing. The Second Schedule does not use the terms 'anonymisation' or 'minimisation'; the closest analogue is the necessity and purpose-limitation standard at (c).

Organisations seeking to rely on the research exemption should: • Clearly define and document the research purpose • Ensure no individual-level decisions are made based on the processed data • Implement the safeguards required by the Second Schedule to the Rules • Maintain records of the safeguards implemented • Separate research data processing from commercial data processing • Consider whether the research activity qualifies for the exemption vs. requiring consent Note: Clinical research remains subject to the New Drugs and Clinical Trials Rules, 2019, which have a 'higher degree of protection' for consent that remains the prevailing standard for those activities.