Certain provisions do not apply where processing is necessary for enforcing a legal right or claim, or is carried out by a court, tribunal or other body performing a judicial, quasi-judicial, regulatory or supervisory function.
Further exemptions cover processing for the prevention, detection, investigation or prosecution of an offence, processing for a scheme of compromise, arrangement, merger or amalgamation approved by a competent authority, and processing to ascertain the financial information and assets of a defaulter.
Processing of the personal data of Data Principals who are not within India, carried out under a contract with a person outside India by a person based in India, is also exempted from the relevant provisions.
The Central Government may notify Data Fiduciaries or classes of them, including start-ups, to whom specified provisions do not apply, having regard to the volume and nature of the personal data they process.
Scope of relief
partial, and named. An exemption switches off identified provisions in identified situations. Nothing in the section exempts a business from the Act at large.
Where people go wrong
Reading the start-up power as an exemption already in hand. It operates by notification, and it reaches specified provisions rather than the whole Act.
Treating an exemption as covering the business rather than the processing. The situations in section 17 are defined by what is being done, not by who is doing it.
Assuming an exemption removes the security obligation. The relief is from identified provisions, and the exemptions are drawn so that core obligations continue to apply.
Relying on the outsourcing exemption for data about people in India. It concerns Data Principals who are not within India.
Common questions
Are start-ups exempt from the DPDP Act?
Not automatically. Section 17(3) lets the Central Government notify certain Data Fiduciaries, including start-ups, as ones to whom specified provisions do not apply, having regard to the volume and nature of the personal data processed. The relief depends on that notification and is limited to the provisions named in it.
Is data processed for Indian clients of an overseas contract exempt?
The exemption concerns the personal data of Data Principals who are not within India, processed under a contract with a person outside India by a person based in India. It does not reach data about people in India.
Does an exemption switch off the whole Act?
No. Section 17 disapplies identified provisions in identified situations. A business relying on one still has to identify exactly which provisions it reaches.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.