Exemptions (Section 17)

Section 17 of the Digital Personal Data Protection Act, 2023 (DPDP Act) sets out specific exemptions from certain obligations under the Act. These exemptions recognize that, in limited situations, applying every provision of the Act may not be appropriate due to public interest, legal requirements, or the nature of the processing activity. Importantly, Section 17 does not create a blanket exemption from the entire Act. The scope of each exemption depends on the specific provision, purpose, and conditions prescribed in the legislation.

The exemptions under Section 17 cover a range of scenarios. These include processing of personal data for the prevention, detection, investigation, or prosecution of offences; enforcement of legal rights or claims; judicial or quasi-judicial functions; processing necessary to comply with judgments, decrees, or legal obligations; research, archiving, or statistical purposes where applicable conditions are met; mergers, amalgamations, or corporate restructuring approved by a competent authority; and other situations specified under the Act. The Central Government is also empowered to exempt certain Data Fiduciaries or classes of Data Fiduciaries, including specified government instrumentalities, from particular provisions of the Act under defined circumstances.

Organizations should interpret Section 17 carefully rather than assuming that an exemption removes all privacy obligations. Each exemption has a defined legal scope and should be applied only where its statutory conditions are satisfied. Even where an exemption is available, organizations should maintain appropriate governance, document the legal basis for relying on the exemption, implement reasonable security safeguards, and be prepared to demonstrate why the exemption applies. Misinterpreting Section 17 may expose organizations to compliance risks and regulatory scrutiny.

In practice, gaps emerge when:

• Organizations assume an exemption removes all obligations under the DPDP Act.
• Exemptions are applied without documenting the legal basis or supporting evidence.
• Business teams rely on broad interpretations instead of assessing the specific conditions under Section 17.
• Internal policies fail to distinguish between exempt and non-exempt processing activities.
• Processing activities continue under an exemption even after the qualifying circumstances no longer exist.

Organizations reduce compliance risks by documenting the purpose of processing, maintaining records supporting reliance on exemptions, periodically reviewing exempt processing activities, and involving legal and privacy teams when interpreting statutory provisions. Within Privy, capabilities such as data discovery, data mapping, governance workflows, privacy assessments, and audit-ready reporting help organizations document processing activities and demonstrate accountability when exemptions are relied upon.