How to Apply the Scheme and Merger Exemption Under Section 17(1)(e) of the DPDP Act
When an undertaking changes hands under a sanctioned scheme, the personal data in it moves too, and nobody asks the data principals first. The Act provides for that, but more narrowly than the deal documents usually assume. The scheme and merger exemption in clause (e) of section 17(1) attaches to an approved scheme rather than to a transaction, and it leaves two obligations standing.
Step 1: Fix the Commencement Position
Section 17 belongs to the group that comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. So do the Chapter II and Chapter III provisions that the exemption operates on.
The planning value is immediate even so. A scheme filed now may well be implemented after the obligations commence, so the data provisions of the scheme have to be drafted for the later position rather than the present one, and the implementation steps have to be sequenced against the commencement date.
Step 2: Establish Exactly What the Exemption Switches Off
Section 17(1) provides that the provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply in the listed cases. Chapter II is sections 4 to 10 and Chapter III is sections 11 to 15.
Applied to a scheme, that removes the grounds for processing in section 4, the notice obligation, the consent machinery, the legitimate uses, the children's provisions, the additional obligations of a significant data fiduciary in section 10, the whole of the data principal's rights and duties in Chapter III, and the restriction on processing personal data outside India in section 16. It is a substantial carve out and it is easily overstated, which is the subject of the next step.
Step 3: Note the Two Obligations That Survive
Sub-sections (1) and (5) of section 8 are expressly carved back in. Section 8(1) makes the data fiduciary responsible for complying with the Act and the rules, irrespective of any agreement to the contrary or any failure of the data principal to carry out her duties, in respect of processing undertaken by it or on its behalf by a data processor. Section 8(5) requires it to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent a personal data breach.
So the security obligation runs through the transaction without interruption, and it runs on the transferor, the transferee and any processor acting for either. A data room, a migration cut over and a post implementation reconciliation are each within section 8(5), and the exemption does nothing for any of them.
Step 4: Check That There Is an Approved Scheme
Clause (e) is engaged where the processing is necessary for a scheme of compromise or arrangement, a merger or amalgamation of two or more companies, a reconstruction by way of demerger or otherwise, a transfer of the undertaking of one or more companies to another, or a division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law in force.
The approval is part of the condition, not a later formality. On the words of the clause a transaction that never goes before a court, tribunal or competent authority is not within it, which puts a share purchase, a business transfer by agreement and a slump sale outside the clause however much data they move. Those need a ground of their own.
Step 5: Do Not Read the Clause as Limited to the Companies Act
The common route is a scheme sanctioned by the National Company Law Tribunal under section 232 of the Companies Act, 2013, with section 231 giving the Tribunal power to enforce a compromise or arrangement it has sanctioned. But the clause says a court or tribunal or other authority competent to do so by any law in force.
That wording is wider than one statute, and it should be read as such where a scheme or amalgamation is sanctioned by a sectoral authority under its own legislation. The point to settle on each matter is which authority is competent and under which law, because that is what the clause asks.
Step 6: Give the Pre-approval Phase Its Own Analysis
Diligence happens before any approval, which is the period the clause does not reach. Clause (a) of section 17(1) is directed at processing necessary for enforcing any legal right or claim, and clause (b) at processing by a court, tribunal or other body performing a judicial, quasi-judicial, regulatory or supervisory function, so neither is an obvious fit for a seller disclosing employee and customer records to a bidder.
Treat the diligence phase as a separate question to be answered on its own facts, and record the answer. The candidates are a ground under section 4 for the disclosure itself, restricting the disclosure to data that is not personal data, or deferring the personal data until the scheme is approved and the clause is available. Which of those works depends on the transaction, and asserting the exemption for the whole timeline is the error to avoid.
Step 7: Date the Exemption and Draft the Scheme to Match
The exemption is tied to processing necessary for the scheme, so it begins when there is an approved scheme to be necessary for and it ends when the processing is no longer necessary for it. Migration of a customer database into the transferee's systems is within that; continuing to market to the same customers afterwards is not.
Draft the scheme and the implementation documents so the record shows which processing was done for the scheme, by whom and over what period. That record is what supports the clause later, and the responsibility under section 8(1) cannot be allocated away by the scheme documents whatever they say.
Common Pitfalls to Avoid
Calling it an M and A exemption: Clause (e) is engaged by a scheme approved by a court, tribunal or other competent authority, not by a transaction.
Applying it to a share purchase or business transfer: Neither is approved by a court, tribunal or other competent authority, so the clause does not reach them.
Assuming the whole Act falls away: Section 17(1) preserves sub-sections (1) and (5) of section 8.
Forgetting the security obligation in the data room: Section 8(5) applies to processing by the fiduciary and by any processor acting on its behalf.
Treating diligence as covered: The clause requires an approved scheme, and diligence precedes approval.
Reading the clause as a Companies Act provision: It refers to any authority competent to approve the scheme by any law in force.
Allocating responsibility by agreement: Section 8(1) applies irrespective of any agreement to the contrary.
Key Statutory Provisions
Section 17(1) of the Digital Personal Data Protection Act, 2023: Exemptions. The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 do not apply in the cases listed in clauses (a) to (f). Clause (e) covers processing necessary for a scheme of compromise or arrangement, a merger or amalgamation, a reconstruction by way of demerger or otherwise, a transfer of undertaking or a division of companies, approved by a court or tribunal or other authority competent to do so by any law in force.
Section 8 of the Act: General obligations of a data fiduciary. Sub-section (1) imposes responsibility irrespective of any agreement to the contrary or any failure by the data principal to carry out her duties, including for processing by a data processor on the fiduciary's behalf, and sub-section (5) requires reasonable security safeguards to prevent a personal data breach. Both survive the exemption.
Chapter II and Chapter III of the Act: Chapter II runs from section 4, the grounds for processing personal data, to section 10, the additional obligations of a significant data fiduciary. Chapter III runs from section 11, the right to access information about personal data, to the duties of a data principal. Both chapters are displaced by section 17(1) save for sub-sections (1) and (5) of section 8.
Section 231 and section 232 of the Companies Act, 2013: Section 232 governs merger and amalgamation of companies and is the usual route to a sanctioned scheme, and section 231 gives the Tribunal power to enforce a compromise or arrangement it has sanctioned.
Sources and References
Section 17 of the Digital Personal Data Protection Act, 2023, bare text of clauses (a) to (f)
Section 232 of the Companies Act, 2013, merger and amalgamation of companies
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapter IV
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments