Compliance
Section 17 of the Digital Personal Data Protection Act offers limited, situation‑specific relief, switching off only named provisions for certain processing activities and for notified start‑ups, so firms must map exactly which obligations are lifted and which remain in force.
Check your DPDP readiness — free More on the blogSection 17 of the Digital Personal Data Protection Act, 2023, lists circumstances where parts of the law do not apply. The relief is not blanket; it only removes identified provisions for specific processing activities. This means a business must first determine whether its data handling falls within one of the listed situations before it can claim any exemption.
The Act is disapplied where processing is necessary to enforce a legal right or claim, or when a court, tribunal or any body performing a judicial, quasi‑judicial, regulatory or supervisory function carries out the processing. In these cases, the identified provisions simply do not bind the data fiduciary for that particular activity. Additional exemptions cover processing that aids the prevention, detection, investigation or prosecution of an offence, as well as processing linked to a scheme of compromise, arrangement, merger or amalgamation that has been approved by a competent authority. The law also relieves a fiduciary when it processes personal data to ascertain the financial information and assets of a defaulter.
If a data fiduciary based in India processes personal data of individuals who are not physically present in India, and the processing is carried out under a contract with a person outside India, the relevant provisions are exempted. This exemption does not extend to data about Indian residents, even if the contract is with an overseas entity.
The Central Government may, by notification, declare that certain data fiduciaries – including start‑ups – are exempt from specific provisions of the Act. The notification is based on the volume and nature of personal data they process. Importantly, the relief is limited to the provisions named in the notification and does not remove the entire regulatory framework. A common mistake is to assume that being a start‑up automatically grants an exemption. The notification must be issued first, and it only covers the provisions specified in that notice. Without the notification, the start‑up remains fully bound by the Act. Another error is to treat an exemption as covering the whole business rather than the specific processing activity. Section 17 is activity‑centred; the exemption applies only to the processing described, not to all data handling undertaken by the firm. Finally, businesses sometimes think that an exemption removes the security obligations altogether. The law is drafted so that core duties – such as implementing reasonable security practices – continue to apply unless the notification expressly lifts them, which is rare.
No. Section 17(3) requires a formal notification from the Central Government. Until that notice is issued, the start‑up must comply with all provisions of the Act.
No. The exemption only covers personal data of individuals who are not within India. Data about Indian residents remains subject to the Act even if processed under an overseas contract.
The Act disapplies provisions for processing needed to enforce legal rights or claims, for judicial or regulatory bodies, for offence prevention or investigation, for approved merger or amalgamation schemes, and for assessing a defaulter's financial information.
Yes. Section 17 only switches off the identified provisions. Core security obligations generally remain in force unless the specific notification explicitly removes them, which is uncommon.
Published 2 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.