top of page
Search

How to Rely on the Research and Statistical Exemption Under Rule 16 of the DPDP Rules 2025

Writer: Kaustav Chowdhury
Kaustav Chowdhury
Oct 12
6 min read

Updated: 17 hours ago

The research and statistical exemption is the widest carve out in the Digital Personal Data Protection framework and the easiest to overstate. Section 17 of the Digital Personal Data Protection Act, 2023 disapplies the Act to processing necessary for research, archiving or statistical purposes, and rule 16 of the Digital Personal Data Protection Rules, 2025 makes that disapplication conditional on the standards in the Second Schedule. The exemption is therefore earned rather than claimed.

Step 1: Fix the Commencement Position

Section 17 and rule 16 both commence with the eighteen month tranche. Under the commencement notification G.S.R. 843(E) dated November 13, 2025, sections 7 to 17 come into force eighteen months after publication, and rule 16 sits in the matching group with rules 3, 5 to 16, 22 and 23 under the Rules notified by G.S.R. 846(E) of the same date.

So a research programme being designed now is being designed against an exemption that becomes available in May 2027. That is useful rather than academic: the Second Schedule standards are governance commitments that take time to put in place, and a programme that cannot evidence them from the outset will not be able to rely on the exemption when it arrives.

Step 2: Read the Exemption as Two Conditions, Not One

Rule 16 provides that the provisions of the Act shall not apply to the processing of personal data necessary for research, archiving or statistical purposes if it is carried on in accordance with the standards specified in the Second Schedule. The rule is one sentence and it carries two conditions.

The first is that the processing is necessary for one of the three named purposes. The second is that it is carried on in accordance with the Schedule. Both have to hold throughout. Section 17 adds the limit that matters most in practice: the exemption is directed at processing that is not used to make any decision specific to a data principal. A study whose output is applied back to an identified individual is outside the carve out however the programme is labelled.

Step 3: Decide Which of the Three Purposes You Are In

Research, archiving and statistical purposes are listed together but they are not the same activity, and the record should say which one the processing serves. Archiving is retention for its own sake, statistical purposes are aggregate analysis, and research is the generation of new knowledge.

The characterisation matters because the necessity test in rule 16 is measured against the purpose claimed. Data retained for archiving cannot be justified by reference to a statistical use that was never undertaken, and the reverse is equally true. Record the purpose at the point of collection, not when a question is asked.

Step 4: Build to the Eight Standards in the Second Schedule

The Second Schedule opens by requiring appropriate technical and organisational measures to ensure effective observance of the standards that follow. Those standards are that the processing is lawful; that it is for the permitted purpose; that it is limited to the personal data necessary for that purpose; that reasonable efforts are made to ensure the accuracy of the personal data; that the personal data is retained only for as long as required for the purpose or for compliance with law; that reasonable security safeguards are taken to prevent a personal data breach, including where a data processor is engaged; that an intimation is given to the data principal where the Schedule's notice standard applies; and that accountability rests with the person who determines the purpose and means of the processing.

Read as a set, these are the Act's own principles reimposed as conditions of the exemption. Nothing in the Schedule permits open ended retention, unminimised collection or weaker security. The honest way to describe the carve out to a client is that it removes the consent and rights machinery, not the discipline.

Step 5: Note That the Schedule Is Shared, and Read It Carefully

The Second Schedule is not written for research alone. It sets the standards both for processing by the State for the uses in section 7(b) and for the purposes in section 17, and parts of it are framed in the language of the State use case. The notice standard in particular is expressed to apply where the State processing limb applies.

Do not resolve that by assuming the awkward limbs fall away. Record the position taken on each standard and the reason, because a conditional exemption read down by the person relying on it is the first thing an auditor or the Board will test. Where a standard plainly cannot apply to a research programme, say so in the file rather than leaving the gap unexplained.

Step 6: Keep the Decision Specific Test Live

The requirement that the processing not be used to make a decision specific to a data principal is not a one time design question. It is a constraint on what the programme may do with its own outputs for as long as it holds the data.

That has consequences for how results travel. A model trained under the exemption and then used to score an identified customer has moved outside it, and so has an archive consulted to decide an individual claim. Build the boundary into access controls rather than into a policy document, and log the crossings.

Step 7: Document the Claim Before You Need It

An exemption is a position the fiduciary asserts, so the evidence has to exist before the assertion is tested. The file should carry the purpose, the necessity reasoning, the data categories and why each is required, the retention period and its trigger, the security measures, the accountable person, and the boundary that keeps outputs away from individual decisions.

Keep it as a standing document that is reviewed when the programme changes, not as a memorandum written once. A programme that drifts into a new purpose has not lost the exemption by accident; it has stopped meeting the condition on which the exemption rests.

Common Pitfalls to Avoid

  • Treating the exemption as unconditional: Rule 16 disapplies the Act only where the processing is carried on in accordance with the Second Schedule standards.

  • Labelling a commercial programme as research: The necessity test is measured against the purpose claimed, and product development driven by a research label is the obvious challenge.

  • Using the output on an identified person: Section 17 directs the carve out at processing that is not used to make a decision specific to a data principal.

  • Reading the Schedule as lighter than the Act: Lawfulness, purpose limitation, minimisation, accuracy, retention limits, security and accountability are all in it.

  • Forgetting processors: The security standard extends to processing carried on by a data processor engaged for the programme.

  • Letting the purpose drift: The condition has to hold throughout, so a programme that changes purpose has to be reassessed rather than grandfathered.

  • Claiming it from today: Section 17 and rule 16 commence with the eighteen month tranche, so an advisory that treats the exemption as presently available is wrong on status.

Key Statutory Provisions

  • Section 17 of the Digital Personal Data Protection Act, 2023: The exemptions, including the disapplication of the Act to processing necessary for research, archiving or statistical purposes, directed at processing that is not used to make a decision specific to a data principal and subject to such standards as may be prescribed.

  • Rule 16 of the Digital Personal Data Protection Rules, 2025: The provisions of the Act do not apply to the processing of personal data necessary for research, archiving or statistical purposes if it is carried on in accordance with the standards specified in the Second Schedule.

  • The Second Schedule to the Rules: Appropriate technical and organisational measures to ensure observance of eight standards, being lawfulness, the permitted purpose, limitation to the personal data necessary, accuracy, retention only while required, reasonable security safeguards including where a processor is engaged, intimation to the data principal where that standard applies, and accountability of the person determining the purpose and means of processing.

Related in This Series

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page