Chapter IV: Special Provisions

Section 17: Exemptions

←Sec. 16Sec. 18→

Simple Explanation

Section 17 provides exemptions where standard DPDP rules do not apply: 1. Legal Rights: Processing needed to enforce legal rights or claims. 2. Judicial/Regulatory Functions: Courts, tribunals, and regulatory bodies performing their functions. 3. Law Enforcement: Prevention, detection, or prosecution of offences. 4. Cross-border Contracts: Processing under contracts with foreign persons. 5. Corporate Restructuring: Mergers, amalgamations, or demergers approved by courts. 6. Financial Default: Ascertaining financial information of loan defaulters (under Insolvency and Bankruptcy Code). 7. State Instrumentalities: Processing by government entities for sovereignty, integrity, security, public order, or preventing cognizable offences. 8. Research: Processing for research, archiving, or statistics if not used for decisions about specific individuals. 9. Startup Exemptions: The government may exempt startups and certain Data Fiduciaries from specific obligations.

Key Points

  • ✓Multiple exemptions for specific purposes
  • ✓Law enforcement and judicial functions are exempted
  • ✓State instrumentalities get exemptions for security and sovereignty
  • ✓Research and statistical purposes may be exempted
  • ✓Startups and certain fiduciaries can be exempted by government notification
  • ✓Corporate restructuring and loan default cases have exemptions

Official Text (Summary)

Certain provisions of the Act do not apply where processing is necessary for: enforcing legal rights or claims; judicial or regulatory functions; prevention, detection, or prosecution of offences; processing under contracts with persons outside India; corporate restructuring approved by courts; ascertaining financial information of loan defaulters; or processing by State instrumentalities for sovereignty, security, public order, etc. The government may also exempt startups and certain Data Fiduciaries from specific provisions.

Source: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Ministry of Law and Justice.

Jump to any Section

Sec. 1Sec. 2Sec. 3Sec. 4Sec. 5Sec. 6Sec. 7Sec. 8Sec. 9Sec. 10Sec. 11Sec. 12Sec. 13Sec. 14Sec. 15Sec. 16Sec. 17Sec. 18Sec. 19Sec. 20Sec. 21Sec. 22Sec. 23Sec. 24Sec. 25Sec. 26Sec. 27Sec. 28Sec. 29Sec. 30Sec. 31Sec. 32Sec. 33Sec. 34Sec. 35Sec. 36Sec. 37Sec. 38Sec. 39Sec. 40Sec. 41Sec. 42Sec. 43Sec. 44

More Sections in Chapter IV

Sec. 16Sec. 17

All Chapters

I. PreliminaryII. Obligations of Data FiduciaryIII. Rights and Duties of Data PrincipalIV. Special ProvisionsV. Data Protection Board of IndiaVI. Powers, Functions and Procedure to be Followed by BoardVII. Appeal and Alternate Dispute ResolutionVIII. Penalties and AdjudicationIX. Miscellaneous

Is your business DPDP compliant?

Avoid penalties up to ₹250 Crore. Let our experts help you implement consent management, grievance redressal, and data protection measures.

Get a Free Compliance Audit