Exemptions under DPDP

Audience: founders, operators, legal-adjacent teams, policy readers · Last reviewed: March 2026

Exemptions are where businesses often become overconfident. The presence of an exemption does not automatically mean “privacy no longer matters here.” Usually it means the team has to understand exactly what is carved out, under what conditions, and what other obligations or business risks still remain.

What official text says

The DPDP framework includes situations where all or part of the ordinary obligation set may not apply in the same way. But the specific language, purpose, and scope of each exemption matter enormously. Some are tied to context, some to actor category, and some to particular kinds of functions or legal settings. That is why teams should read the statutory text and any connected official materials before claiming an exemption internally.

Secondary summaries often flatten these distinctions and create a dangerous impression that “if we are near an exempt category, we are probably fine.” That is not a professional way to assess exposure.

What Section 17 actually exempts

Section 17(1) removes most Chapter II and III obligations (notice, consent, Data Principal rights) for: enforcing a legal right or claim; processing by courts, tribunals, or regulators performing a judicial, quasi-judicial, or regulatory function; prevention, detection, investigation, or prosecution of offences; processing of data belonging to people outside India under a contract between a person based in India and a person outside India (s.17(1)(d)); mergers, demergers, and similar court-approved restructurings; and checking a loan defaulter’s financial position. Section 17(2) adds two more: state instrumentalities the Central Government notifies for sovereignty, security, public order, or foreign relations reasons, and processing for research, archiving, or statistical purposes that meets prescribed standards.

Section 17(3) is the one most often misread. It lets the Central Government in the future notify certain Data Fiduciaries — including startups — as exempt from only four things: Section 5 (notice), Section 8(3) and 8(7) (data-quality and erasure duties), Section 10 (Significant Data Fiduciary obligations), and Section 11 (the Data Principal’s right to access information). Check the Gazette for any notification issued under s.17(3); it would not be a blanket exemption even once issued, and it would never touch consent, security safeguards, or breach notification. Section 17(5) also lets the government grant temporary exemptions, but only for up to five years from the Act’s commencement.

Practical meaning for companies

For commercial businesses, the most useful question is usually not “can we avoid DPDP entirely?” but:

• which exact workflow do we think falls outside or is treated differently?
• what official text supports that reading?
• what evidence would we show if asked to explain the choice?
• what good-practice controls should we keep anyway?

Even where a legal exemption or special treatment exists, companies often still need internal discipline around access control, retention, security, complaint handling, and vendor visibility. Businesses that overread exemptions usually end up with process sprawl and weak documentation.

How to review an exemption claim

1. Write down the exact exemption or carve-out being relied on.
2. Map the data, purpose, systems, and parties involved.
3. Check whether the facts truly fit the official language.
4. Identify what duties remain as a matter of law, contract, security, or common sense.
5. Document the decision owner and review it again when the workflow changes.

Caveats

• Do not confuse exemptions with broad freedom to reuse data however convenient.
• Do not assume an exempt workflow stays exempt after product, market, or vendor changes.
• Do not ignore sector rules, contracts, or customer expectations just because DPDP treatment may differ.
• Do not let exemptions become an undocumented tribal-memory decision.

Official sources

Related guides