Alerts & Updates 16th Jul 2026
The Digital Personal Data Protection Act, 2023 (DPDPA) establishes a structured framework of rights for data principals and obligations for data fiduciaries, anchored in the Supreme Court’s recognition of privacy as a fundamental right. However, Section 17 of the DPDPA introduces a significant asymmetry into this framework, permitting the Central Government to exempt its own instrumentalities from the provisions of the DPDPA by executive notification, raising important questions around the absence of defined limits on such exemptions and the institutional checks available to scrutinise their exercise.
In this primer, we examine the architecture of Section 17 and its interplay with the institutional design of the Data Protection Board of India and explore whether the exemption powers reserved by the Central Government are subject to meaningful external checks and balances. We also analyze Section 17(2)(a) against the constitutional standards likely to govern its validity and consider why it remains the least constrained provision in the DPDPA itself.
As per the rules of the Bar Council of India, lawyers and law firms are not permitted to solicit work or advertise. By clicking on the "I Agree" button, you acknowledge and confirm that you are seeking information relating to Economic Laws Practice (ELP) of your own accord and there has been no advertisement, personal communication, solicitation, invitation or any other inducement of any sort whatsoever by or on behalf of ELP or any of its members to solicit any work through this website.
