Data Privacy · DPDP Act 2023

Exemptions — startups, research, legal claims, and the State

Section 17 switches off parts of the DPDP Act for a defined list of situations. These include enforcing legal rights, courts and regulators, investigations, offshore contracts, mergers, and loan defaults. It also switches the Act off entirely for notified State instrumentalities. It also switches the Act off for research, archiving or statistical work, but only if it never drives a decision about one person and follows the standards in Rule 16 and the Second Schedule (Section 17(2)(b)).

Educational only · not legal adviceLast updated: 9 October 2026Written and edited by Sandesh Kokate

In plain English

Section 17(1) doesn't switch off the Act. It switches off three parts of it: the chapter of Data Fiduciary duties (Chapter II), the Data Principal rights chapter (Chapter III), and section 16.

Chapter II is more than notice and consent. It also holds breach reporting, retention and erasure, children's data, and the extra duties of a Significant Data Fiduciary. In the listed cases none of these apply, except section 8(1) and section 8(5).

That happens only in a closed list of situations:

enforcing a legal right or claim
courts and regulators doing their job
investigating offences
work done in India under a contract with a foreign party, about people outside India
court-approved mergers and demergers
checking the finances of a loan defaulter

Two duties survive even there: the section 8(1) accountability duty, and the section 8(5) security-safeguards duty.

Section 17(2) goes further: it switches the whole Act off in two cases.

The first is State bodies that the Central Government notifies on national-security grounds. The second is research, archiving, or statistical work. That work must never drive a decision about one person. It must also follow the prescribed standards. Rule 16 anchors those standards to the Second Schedule.

The startup relief in section 17(3) is not automatic. It only applies to Data Fiduciaries the Central Government actually notifies. Until such a notification issues, the full set of duties applies to your startup.

Think of it like

A "no entry" street sign with a small plate underneath saying "except emergency vehicles, residents, and deliveries". The road rule still exists; specific vehicles are listed as exceptions. Being a startup is not on the plate yet. The council must add your group before you may drive through.

Key takeaways

Section 17(1) is a partial exemption. Chapter II (except section 8(1) and 8(5)), Chapter III, and section 16 fall away. Section 8(1) and 8(5) still apply: you stay responsible for the data and must keep it safe.
The list is closed. It covers:
- legal claims
- judicial, quasi-judicial, or regulatory bodies
- offence investigation
- offshore-contract processing of non-Indian Data Principals
- court-approved corporate restructuring
- loan-default financial checks
Section 17(2) is a full exemption. It covers only notified State instrumentalities, and research, archives or statistics that never drive a decision about one person.
Research relief depends on the Second Schedule standards (Rule 16). It is not a free pass.
Startup relief under section 17(3) needs a Central Government notification naming the class; it is not self-executing.
Section 17(5) lets the Government suspend any provision for named Data Fiduciaries within five years of commencement.

What this means for you

Founders

Do not plan around the startup exemption — it needs a notification that does not exist yet. Build for full compliance, and treat any relief as a bonus.

Freelancers

Say you work in India under a contract with an overseas client, about people outside India. That sits inside the section 17(1)(d) carve-out. But you still owe accountability and security.

Creators

Keeping evidence to pursue or defend a legal claim (say, an impersonation case) is covered. General audience analytics is not "research" under section 17(2)(b).

Status

EnforceableCore obligations enforceable 13 May 2027. On the statute book since 13 November 2025. The Data Protection Board is not yet hearing complaints.

Primary sources

Source

MeitY — DPDP Act (Gazette PDF)

Notified — checked 2026-10-06. Opened the DPDP Act, 2023 (Gazette PDF). Partly in force: most duties start 13 May 2027 (G.S.R. 843(E)).

Source

MeitY — DPDP Rules, 2025 (Gazette PDF)

Notified — checked 2026-10-06. Opened the DPDP Rules, 2025 (Gazette PDF).

Official text

Official text — Section 17, DPDP Act, 2023

SECTION 17 — Exemptions (DPDP Act, 2023) 17. (1) The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where— (a) the processing of personal data is necessary for enforcing any legal right or claim; (b) the processing of personal data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processing is necessary for the performance of such function; (c) personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India; (d) personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India; (e) the processing is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force; and (f) the processing is for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force. Explanation.—For the purposes of this clause, the expressions "default" and "financial institution" shall have the meanings respectively assigned to them in sub-sections (12) and (14) of section 3 of the Insolvency and Bankruptcy Code, 2016. Illustration. X, an individual, takes a loan from Y, a bank. X defaults in paying her monthly loan repayment instalment on the date on which it falls due. Y may process the personal data of X for ascertaining her financial information and assets and liabilities. (2) The provisions of this Act shall not apply in respect of the processing of personal data— (a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and (b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed. (3) The Central Government may, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or class of Data Fiduciaries, including startups, as Data Fiduciaries to whom the provisions of section 5, sub-sections (3) and (7) of section 8 and sections 10 and 11 shall not apply. Explanation.—For the purposes of this sub-section, the term "startup" means a private limited company or a partnership firm or a limited liability partnership incorporated in India, which is eligible to be and is recognised as such in accordance with the criteria and process notified by the department to which matters relating to startups are allocated in the Central Government. (4) In respect of processing by the State or any instrumentality of the State, the provisions of sub-section (7) of section 8 and sub-section (3) of section 12 and, where such processing is for a purpose that does not include making of a decision that affects the Data Principal, sub-section (2) of section 12 shall not apply. (5) The Central Government may, before expiry of five years from the date of commencement of this Act, by notification, declare that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification.

Official text — Rule 16, DPDP Rules, 2025

RULE 16 — Exemption from Act for research, archiving or statistical purposes (DPDP Rules, 2025) 16. The provisions of the Act shall not apply to the processing of personal data necessary for research, archiving or statistical purposes if it is carried on in accordance with the standards specified in Second Schedule.

Quick self-check

Am I a Data Fiduciary?

Run the 2-minute self-check to see which DPDP duties apply to you before assuming an exemption covers you.

Run it now

Citation

Kokate, S. (2026). Exemptions — startups, research, legal claims, and the State. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/exemptions. Educational content, not legal advice.

← Back to Data Privacy hub Retention & erasure →

The Rules are dated 13 November 2025 and were published in the Gazette on 14 November 2025. Some sources therefore give 14 May 2027. We use 13 May 2027; see Methodology.