Section 17 of Digital Personal Data Protection Act, 2023 - Exemptions
Section 17 of the Digital Personal Data Protection Act, 2023 (DPDP Act) creates specific exemptions from selected obligations and rights under the Act. The exemptions cover matters such as legal claims, judicial and regulatory functions, investigation and prosecution, certain overseas contractual processing, corporate restructuring, loan-default related financial information, notified State instrumentalities, research and specified classes of Data Fiduciaries.
For the official statutory text, see the Digital Personal Data Protection Act, 2023 on India Code. The implementation framework is supplemented by the Digital Personal Data Protection Rules, 2025 and commencement notifications issued by the Ministry of Electronics and Information Technology.
Meaning and scope of Section 17
An exemption means that the provisions identified in Section 17 do not apply to the specified processing, person or class of Data Fiduciaries to the extent stated in the section. Section 17 does not create one blanket exemption for all processing. Each sub-section has its own subject, conditions and legal effect.
| Provision | Broad subject |
|---|---|
| Section 17(1) | Specified processing including legal claims, courts and tribunals, offences, certain overseas contracts, corporate restructuring and loan defaults. |
| Section 17(2) | Notified State instrumentalities and qualifying research, archiving or statistical processing. |
| Section 17(3) | Power to exempt notified Data Fiduciaries or classes, including startups, from specified provisions. |
| Section 17(4) | Limited exclusions concerning processing by the State or its instrumentalities. |
| Section 17(5) | Transitional power to exempt a Data Fiduciary or classes of Data Fiduciaries for a specified period. |
Section 17(1) - Exemptions for specified processing
Sub-section (1) provides that Chapter II, except section 8(1) and section 8(5), Chapter III and section 16 do not apply where the processing falls within one of the listed purposes or situations.
(a) Enforcement of legal rights or claims: processing may fall within the exemption where it is necessary for enforcing a legal right or claim.
(b) Judicial, quasi-judicial, regulatory or supervisory functions: the exemption covers necessary processing by a court, tribunal or another body in India entrusted by law with such functions.
(c) Prevention, detection, investigation or prosecution: personal data processing in the interest of prevention, detection, investigation or prosecution of an offence or contravention of Indian law is covered.
(d) Processing for certain overseas contracts: the provision covers personal data of Data Principals outside India processed pursuant to a contract with a person outside India by a person based in India.
(e) Corporate restructuring: necessary processing for a court, tribunal or legally competent authority approved compromise, arrangement, merger, amalgamation, reconstruction, demerger, transfer of undertaking or division of companies is covered.
(f) Loan or advance defaults: processing may be undertaken to ascertain the financial information, assets and liabilities of a person who has defaulted on payment of a loan or advance from a financial institution, subject to applicable legal provisions governing disclosure of information or data.
Meaning of "default" and "financial institution"
For Section 17(1)(f), the Act adopts the meanings of "default" and "financial institution" assigned by section 3(12) and section 3(14), respectively, of the Insolvency and Bankruptcy Code, 2016. In broad terms, "default" concerns non-payment of a debt when it has become due and payable, while "financial institution" is the category defined by the Insolvency and Bankruptcy Code.
Statutory illustration relating to a loan default
The Act illustrates the rule with an individual who takes a bank loan and defaults on a monthly repayment instalment. The bank may process that individual's personal data for ascertaining financial information, assets and liabilities, subject to the conditions stated in the provision.
Section 17(2) - State, research, archiving and statistics
Notified State instrumentalities: the Act does not apply to processing by an instrumentality of the State notified by the Central Government in the interests specified in Section 17(2)(a), including sovereignty and integrity of India, security of the State, friendly relations with foreign States, public order and prevention of incitement to a cognizable offence relating to those interests. The provision also addresses processing by the Central Government of personal data furnished by such an instrumentality.
Research, archiving and statistical purposes: Section 17(2)(b) covers necessary processing for these purposes where the personal data is not used to take a decision specific to a Data Principal and the processing complies with prescribed standards.
Section 17(3) - Exemptions for certain Data Fiduciaries and startups
The Central Government may, having regard to the volume and nature of personal data processed, notify particular Data Fiduciaries or classes of Data Fiduciaries, including startups, so that section 5, section 8(3), section 8(7), section 10 and section 11 do not apply to them.
For this purpose, a "startup" is a private limited company, partnership firm or limited liability partnership incorporated in India that is eligible to be, and is, recognised as a startup under the criteria and process notified by the Central Government department responsible for startup matters.
Section 17(4) - Processing by the State
For processing by the State or any instrumentality of the State, section 8(7) and section 12(3) do not apply. In addition, where the purpose of processing does not include making a decision that affects the Data Principal, section 12(2) does not apply.
Section 17(5) - Transitional exemption power
The Central Government may, before expiry of five years from commencement of the Act, notify that any provision of the Act will not apply to a specified Data Fiduciary or class of Data Fiduciaries for the period stated in the notification. This is a notification-based power and does not itself automatically exempt every Data Fiduciary.
Related provisions
Section 17 should be read with the provisions to which it expressly refers, including Section 11 - Right to access information about personal data, Section 12 - Right to correction and erasure of personal data, and Section 16 - Processing of personal data outside India.
Last updated: 24 September 2026. This page is a general legal information resource. Always verify the current commencement notification, rules and subsequent amendments before applying the provision to a specific matter.