BACK TO DPDP RULES INDEX
DPDP Rules 2025 Phase 3 (13 May 2027) EXEMPTIONS

Rule 22

Exemptions — Procedures and Safeguards

Practical Note

Rule 22 procedural provisions are important for entities that may claim exemptions — government agencies, research institutions, and entities in national security roles need to understand the safeguards required to validly claim exemptions. Claiming an exemption without meeting Rule 22's procedural requirements will not be accepted as a valid defence.

THE STATUTE

Original Text

For the purposes of sub-sections (2) and (3) of section 17, the following safeguards shall apply to the processing of personal data for exempted purposes — (a) research, archival or statistical purposes: data shall be anonymised or pseudonymised to the extent reasonably possible; processing shall be limited to what is strictly necessary; results shall not be published in a form identifying individuals; (b) enforcement of legal rights: processing limited to data relevant to the specific legal proceeding; (c) journalistic purposes: processing limited to data necessary for the publication in public interest.

Analysis & Details

Rule 22 provides the procedural framework for claiming the exemptions in Act Section 17. Section 17 exempts certain processing from some or all of the Act's requirements — including processing for national security, law enforcement, research, archiving, statistics, journalism, and legal proceedings. Rule 22 specifies the safeguards that must be in place for these exemptions to be validly claimed. For RESEARCH AND STATISTICS: Data must be anonymised or pseudonymised to the maximum extent reasonably possible. Processing must be strictly limited to what is necessary. Results cannot be published in a way that identifies individuals. For LEGAL PROCEEDINGS: Data processing limited to information directly relevant to the specific legal proceeding — this prevents litigation-related discovery from becoming a data harvesting exercise. For JOURNALISM: Data processed in the public interest for journalistic purposes must be limited to what is necessary for the specific publication. This is a qualified exemption — not a blanket press exemption. The journalistic purpose must be genuinely in the public interest. The Act's most significant exemption — national security and public order (Section 17(2)(a)) — is not elaborated in Rule 22, suggesting it will be dealt with separately through notifications. The national security exemption allows the Central Government to grant broad exemptions to specified instrumentalities of the State, which will likely include intelligence agencies, military entities, and certain law enforcement bodies.

GDPR Parallel

Articles 23 (Restrictions by Member State law) + Article 85 (Journalistic exemptions)

IT Act Impact

Rule 22's research and journalism exemptions are consistent with similar qualifications in GDPR. The national security exemption has no direct IT Act parallel — the IT Act Section 69 interception powers are a separate legal framework that will continue to operate alongside DPDP exemptions.

Common Queries

Partially. Rule 22 provides a qualified exemption for journalistic processing — but it must be: (a) genuinely in the public interest; (b) limited to data necessary for the specific publication. This is not a blanket press exemption. Collecting personal data for general background purposes, maintaining extensive private databases on individuals, or using data for purposes beyond the specific public interest publication would not be covered by the journalism exemption.
The Central Government can, by notification under Act Section 17(2)(a), exempt 'any instrumentality of the State' from some or all Act provisions 'in the interest of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order'. Rule 22 does not elaborate on this exemption — it will be dealt with through separate notifications. Intelligence agencies and defence establishments are likely candidates for such exemptions.

Key Rules & Provisions

Research exemption requires anonymisation/pseudonymisation — not a blanket exemption.

Legal proceedings exemption limited to directly relevant data.

Journalism exemption requires genuine public interest — not a blanket press exemption.

National security exemption not elaborated in Rule 22 — to be specified separately.