Compliance
Section 17 offers limited, situation‑specific relief from parts of the DPDP Act; businesses must map each exemption, document the scope, and keep records ready for regulator review, otherwise they bear the full compliance cost.
Check your DPDP readiness — free More on the blogFirst, list every personal data operation your firm carries out. Separate activities that are required for legal rights, court orders, offence investigations, merger approvals, or cross‑border contracts with non‑Indian data principals. This inventory must be detailed enough to show the purpose, the data subjects involved, and the legal basis for each activity. The responsibility typically lies with the Chief Compliance Officer together with the Data Protection Officer, if appointed, and the legal team.
Next, cross‑reference each listed activity with the specific exemptions in Section 17. For example, processing done to enforce a claim or by a tribunal falls under the first carve‑out, while data handled for a scheme of merger approved by a regulator fits another. Record the clause number and the exact wording that supports the match. This step is usually performed by the legal counsel, who drafts a matrix linking activities to the relevant exemption language.
If you are a start‑up or belong to a class the government may notify, verify whether a formal notification has been issued for your entity. The notification will list the provisions that are disapplied. Obtain the official document from the Ministry’s portal and file it with your compliance records. The Finance Head or Company Secretary should maintain a register of all such notifications and update it when new ones appear.
Create a written exemption summary that states: the processing activity, the applicable Section 17 clause, the notified provisions (if any), and any conditions attached. Use a standard template so that auditors can quickly locate the information. The Data Protection Officer signs off on the summary, and the CEO retains a copy in the corporate secretarial binder.
For any processing that does not fall within an exemption, apply the full suite of DPDP obligations: consent management, data minimisation, security safeguards, and breach reporting. Assign the IT security manager to configure technical controls, and the privacy team to draft policies. Keep evidence of these controls—risk assessments, security logs, and consent records—ready for inspection.
Conduct a focused training session for teams handling exempted data, clarifying that only the identified provisions are waived. Emphasise that core duties such as maintaining reasonable security and responding to data‑subject requests remain. HR should record attendance and retain the training material for future audits.
Establish a log that captures when an exemption is relied upon, who approved it, and which document justified the reliance. The log should be stored electronically with version control, accessible to the compliance officer and external auditors. This audit trail demonstrates that the exemption was applied correctly and is essential if the regulator queries your practice.
When a regulator or a data‑subject authority asks for proof, be ready to produce the exemption matrix, the notification, the exemption summary, and the audit log. Keep these documents together in a secure folder labelled “DPDP Section 17 Exemptions”. The compliance head should designate a point of contact to handle such requests promptly.
The start‑up must wait for a formal notification from the Central Government that lists its name or class and the specific provisions that are disapplied. Until such a notice is issued, the start‑up remains fully subject to the Act and must comply with all obligations.
No. The exemption only covers personal data of data principals who are not physically present in India, processed under a contract with an entity outside India by an Indian‑based processor. Data of Indian residents remains subject to the full DPDP regime.
Yes. Section 17 removes only the identified provisions; core security obligations are not listed among the exemptions. Companies must continue to implement reasonable security safeguards for all personal data, exempt or not.
The regulator will expect the processing‑activity inventory, the exemption‑mapping matrix, the government notification (if any), the written exemption summary, and the audit log showing who relied on the exemption and when. These documents prove that the exemption was applied correctly.
Published 18 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.