DPDP reference
Section 17: Exemptions
Last checked 6 Nov 2026
Chapter II (other than s.8(1) and s.8(5)), Chapter III and s.16 do not apply to processing necessary to enforce a legal right or claim, by courts and regulators in their functions, to prevent, detect, investigate or prosecute offences, for personal data of people outside India processed under a contract with a person outside India, for court approved mergers and similar schemes, or to find the finances of a loan defaulter (s.17(1)).
The Act does not apply to processing by an instrumentality of the State the Government notifies in the interests of sovereignty and security, or to research, archiving or statistical processing that takes no decision about a specific person and follows prescribed standards (s.17(2)). The Government may notify certain Data Fiduciaries, "including startups", as exempt from s.5, s.8(3), s.8(7), s.10 and s.11 (s.17(3)).
The State is relieved of s.8(7) and s.12(3), and of s.12(2) where no decision about the Data Principal is involved (s.17(4)). Within five years of commencement the Government may exempt Data Fiduciaries from any provision for a stated period (s.17(5)).
- Applies to
- The persons and processing described in each clause. An exemption depends on the clause, so each use needs its own check.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- None of its own. This section sets out how the law works and places no duty on a business.
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 17; G.S.R. 843(E), commencement
Questions
Do security duties still apply under the outsourcing exemption?
Yes. s.17(1) keeps s.8(1) and s.8(5) in place, including for offshore client data processed under a contract with a person outside India (s.17(1)(d)).
Are small businesses exempt from the DPDP Act?
The Act has no size threshold. The Government may notify certain Data Fiduciaries as exempt from some provisions (s.17(3)), and any such notification decides who is covered.
Related
- Section 3: Application of the Act
- Section 7: Certain legitimate uses
- Rule 16: Exemption from Act for research, archiving or statistical purposes
Next
Not legal advice.