DPDP Act Exemptions
What Section 17 actually exempts, and why your business is almost certainly not on the list
DPDP Act Exemptions: The Short List, and the Long Reality
Searching for DPDP Act exemptions usually means one thing: you are hoping the law does not apply to you. Here is the honest answer up front: the exemptions under Section 17 are narrow, specific, and designed for situations like personal use, government functions, and research, not for ordinary businesses.
There is no small-business exemption in the DPDP Act. If you collect even one customer's email digitally, you are a Data Fiduciary, and the full Act applies to you. See exactly who the law covers on our DPDP Act applicability page.
No cost. No obligation. Get your compliance gap report.
The Section 17 Exemptions, One by One
These are the situations where the DPDP Act steps back. Notice how none of them describe a normal commercial business.
Personal or Domestic Use
Data processed by an individual for purely personal or household purposes, like your private contact list or family photo folder, is outside the Act.
Publicly Available Data
Data made public by the individual themselves, or made public under a legal obligation. Data you scraped or bought from elsewhere does not qualify.
Government & National Security
Processing by the State for sovereignty, security, and certain government functions can be exempted. This applies to government bodies, not businesses.
Research & Statistics
Processing for research and statistical purposes can be exempt, subject to prescribed standards. Commercial analytics on customers is not research.
Legal, Court & Enforcement Needs
Processing required for legal rights and claims, court and tribunal functions, and the prevention, detection, and investigation of offences.
Everything Else: No Exemption
Customer data, employee data, vendor data, marketing lists: if it is digital personal data processed by a business, the Act applies in full.
Check My Status, FreeThe "Startup Exemption" Myth
A dangerous rumor keeps circulating: "startups are exempt from DPDP". Here is what is actually true:
- Exemptions for startups are limited and government-notified, applying only to specific classes the government chooses to name
- They are not automatic: being registered as a startup gives you nothing by default
- Even where notified, security obligations still apply, so the ₹250 crore safeguard penalty tier never goes away
Most Businesses Get NO Exemption
If you run an e-commerce store, clinic, school, agency, SaaS product, or any business that collects customer or employee data digitally, you should plan as if no exemption exists, because for you, none does.
Betting your business on an exemption you do not have is a fast route to the DPDP penalty schedule, which goes up to ₹250 crore per violation with no discount for size. The smarter bet is a free audit that tells you exactly what applies to you and what does not.
No Exemption Means the Deadlines Apply to You
Consent rules become mandatory on 13 November 2026 and full enforcement begins on 13 May 2027. Compliance setup takes 2-6 months, so the time to start is now.
Want the Complete DPDP Picture?
Exemptions are the shortest chapter in the Act. Our main guide covers everything else: deadlines, obligations, roles, rights, and penalties.
Learn Everything About DPDP ComplianceDPDP Act Exemptions: Frequently Asked Questions
Personal or domestic use, data made publicly available by the individual or under law, government and national security processing, research and statistical purposes, and legal, court, or enforcement needs. Nothing on that list covers ordinary commercial processing.
Not automatically. Only limited, government-notified exemptions exist for specific classes, and even those do not remove security obligations. There is no small-business exemption in the Act.
Only if the individual made it public themselves, or it was made public under a legal obligation. Scraped or purchased data does not qualify and still needs a lawful basis.
Almost certainly not. If you collect customer, employee, or vendor data digitally, you are a Data Fiduciary and must comply in full. A free audit can confirm your exact position in one session.
Stop Hoping for an Exemption. Start Knowing Your Position.
One free audit tells you exactly which DPDP obligations apply to your business, and the fastest way to meet them before the deadlines.
Book Your Free DPDP AuditNo cost. No obligation. Get your compliance gap report.
Adri IT Software Solutions Pvt Ltd, an IT company based in Vadodara, helping businesses across Gujarat & India become DPDP-compliant before the deadline. Prefer to talk first? Let's Talk.
Disclaimer: This page is for general information only and is not legal advice. The content is based on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as published by the Government of India, explained here in simplified language. For the official text, please refer to the Ministry of Electronics and Information Technology (MeitY). Laws and deadlines may change. For a personalised assessment of your business, book a free DPDP audit with our team.