Exemptions
The provisions of sections 5, 6, 8 and 9, and section 10 shall not apply where processing of personal data is necessary for enforcing any legal right or claim, or is required by any court or tribunal in India for the performance of any judicial or quasi-judicial function.
The Central Government may, by notification, exempt Data Fiduciaries, including start-ups, from the application of the provisions of Chapter II and Chapter III, having regard to the volume and nature of personal data processed.
The Central Government may exempt any instrumentality of the State from the application of any provision of this Act, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, or preventing incitement to any cognisable offence.
Processing of personal data necessary for research, archiving or statistical purposes, if such processing is not used to take any decision specific to a Data Principal, and is carried on in accordance with such standards as may be prescribed, shall be exempt from the application of this Act.
- The 'start-up' exemption is a notification-based carve-out, not automatic — a company merely calling itself a startup does not opt out of Chapter II/III without a specific government notification naming it or its class.
- The government-instrumentality exemption is broad and has drawn the most public debate, since it can exempt state agencies from the Act for reasons like public order or security.
- Research/archiving/statistical exemptions only apply if the output is never used to make a decision about a specific individual.
Reconstructed for readability from the publicly notified DPDP Act, 2023. Always verify exact wording against the official Gazette of India before relying on this for legal or compliance decisions.