Research Exemption (R.16)

Rule 16 specifically provides an exemption for processing of personal data by research institutions, subject to the conditional exemption mentioned in Section 17(2)(b) of the Act. The exemption applies where: 1. Processing is for research, archival, or statistical purposes 2. The personal data is not used for any decision specific to a Data Principal - the 'Non-Individual Decision' rule. If the data is used to impact a specific person (e.g., medical diagnosis or credit scoring), the exemption is immediately voided. 3. The processing is carried out in accordance with the Second Schedule of the Rules, which dictates specific technical and organisational standards (including 'anonymisation or minimalisation' to ensure the identity of the Data Principal cannot be inferred) This creates a limited carve-out for legitimate research activities while ensuring the exemption cannot be used to circumvent Data Principal protections for commercial purposes. It operationalises Section 17 exemptions under the Act.

The research exemption is subject to important conditions: • No individual decisions: The exemption only applies where the data is used for aggregate research, statistical analysis, or archival purposes - not for making decisions about specific individuals. • Second Schedule safeguards: The Second Schedule (prescribed under Rule 16) specifically lists 'anonymisation or minimalisation' as core standards to ensure the identity of the Data Principal cannot be inferred. Research institutions must implement these alongside access restrictions and ethical review processes. • Institutional context: While the Rules use the term 'research institutions,' the underlying Section 17(2)(b) refers to the purpose of the processing. Commercial entities must be extremely careful: if research is a 'secondary activity' used to drive product development (commercial purpose), the exemption likely will not apply. • Purpose limitation: The exemption does not authorise processing for purposes beyond research, archival, or statistics - repurposing research data for commercial applications would exceed the exemption's scope.

Organisations seeking to rely on the research exemption should: • Clearly define and document the research purpose • Ensure no individual-level decisions are made based on the processed data • Implement anonymisation or pseudonymisation in line with the Second Schedule • Obtain ethics committee approval where applicable • Maintain records of the safeguards implemented • Separate research data processing from commercial data processing • Consider whether the research activity qualifies for the exemption vs. requiring consent Note: Section 1 of the DPDP Act ensures it does not override existing specialised laws. Clinical research remains subject to the New Drugs and Clinical Trials Rules, 2019, which have a 'higher degree of protection' for consent that remains the prevailing standard for those activities.