Data protection · Provision

Section 17, DPDP Act 2023 — Exemptions & Start-up Carveouts

Specific situations where certain DPDP provisions do not apply, including legal claims, court orders, mergers, and notified start-up exemptions. (Section 17, Digital Personal Data Protection Act, 2023.)

Quick Statutory Answer

Section 17 of the DPDP Act 2023 carves out targeted statutory exemptions from certain obligations for legal claims, judicial proceedings, criminal investigations, and corporate mergers. Crucially, Section 17(1)(d) exempts foreign data processed under outsourcing contracts by Indian service providers (IT/BPO exports), and Section 17(3) empowers the Central Government to exempt notified start-ups and small enterprises from specific requirements like Section 5 notice and Section 8(7) erasure limits.

Check your compliance exposure — free All provisions

What the section does

  • Certain provisions of the Act (including notice and consent requirements) do not apply where processing is necessary for enforcing any legal right or claim.
  • Processing carried out by a court, tribunal, or authority performing judicial or quasi-judicial functions is exempt from specified provisions.
  • Exemptions apply to processing for the prevention, detection, investigation or prosecution of any offence, or under an approved corporate merger, amalgamation, or compromise.
  • Processing personal data of individuals outside India, conducted by Indian entities under contracts with foreign entities (IT/BPO export outsourcing), is exempt from Section 8 and Section 11 obligations.
  • Under Section 17(3), the Central Government may notify classes of Data Fiduciaries, including start-ups, to whom specific obligations (like notice and retention limits) do not apply.

Section 17 DPDP Act: Statutory Exemptions Matrix & Applicable Provisions

Section 17 DPDP Act: Statutory Exemptions Matrix & Applicable Provisions
Exempted Scenario Statutory Clause Provisions Disapplied Retained Core Obligations
Enforcing Legal Rights / Claims Section 17(1)(a) Notice (s.5) & Consent (s.6) requirements Security safeguards (s.8(5)) still apply
Judicial / Regulatory Functions Section 17(1)(b) Notice, consent and individual access rights Court records and statutory oversight
Offence Investigation / Prevention Section 17(1)(c) Notice, consent and erasure obligations Police / investigating agency access
Corporate Schemes / Mergers Section 17(1)(e) Consent requirement for transfer of assets Court-approved mergers / acquisitions
IT/BPO Foreign Outsourcing Section 17(1)(d) Sections 5, 8(3), 8(7), 10, 11 Security safeguards for foreign clients
Notified Start-ups & SMBs Section 17(3) Specified by notification (e.g. s.5, 8(7)) Security safeguards & breach reporting

Scope of exemption

Partial and conditional. Exemptions switch off specific provisions in specified contexts; no entity has a blanket immunity from the entire Act.

Where people go wrong

  • Assuming start-ups are automatically exempt. Relief under Section 17(3) requires an official notification by the Central Government.
  • Believing an exemption relieves a business from security safeguards. Section 8(5) breach-prevention duties remain in force.
  • Applying the IT/BPO outsourcing exemption to domestic Indian customer data. Section 17(1)(d) applies strictly to foreign data.

Common questions

Are start-ups exempt from the DPDP Act?

Start-ups are not automatically exempt. Section 17(3) empowers the Central Government to notify specific exemptions for start-ups based on the nature and volume of data processed, but until such notification is gazetted, the Act applies in full.

Are Indian IT and BPO companies exempt when processing foreign client data?

Yes. Under Section 17(1)(d), processing of personal data of individuals located outside India, carried out under a contract with a foreign entity, is exempt from key provisions including notice and consent.

Act on this

  • Section 4 — grounds for processing
  • Section 8 — security obligations
  • Free DPDP readiness check

Other provisions

  • Section 32, Digital Personal Data Protection Act
  • Section 15, Digital Personal Data Protection Act
  • Section 5, Digital Personal Data Protection Act
  • Section 14, Digital Personal Data Protection Act
  • Section 6, Digital Personal Data Protection Act
  • Section 13, Digital Personal Data Protection Act

Maintained by the VidhiSar Legal Team

Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.

About this summary

A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.