Section 16 — DPDP Act, 2023
The Central Government may, by rules, exempt any Data Fiduciary or class of Data Fiduciaries from the application of all or any of the provisions of this Act, where the processing of personal data is necessary for— (a) research, archiving or statistical purposes; or (b) any other purpose as may be specified by the Central Government.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 16 grants the Central Government rule-making power to exempt certain research, archiving, and statistical processing from specific Act provisions. The exemption is not self-applying — it requires a government rule, and the exemption applies only to the extent and in the manner specified. Rule 16 of the DPDP Rules 2025 operationalises this: research processing must meet the eight standards in the Second Schedule (covering de-identification, prohibition on commercial use, and other safeguards). Calling something 'research' does not by itself trigger the exemption.
A university research project processing patient data for a public health study can potentially benefit from a Rule 16 exemption — but only if the processing meets all eight Second Schedule standards, including that the data is de-identified to the extent possible and is not used for any commercial purpose.
An e-commerce platform processing purchase data to build a recommendation algorithm is not 'research' for purposes of Section 16 — it is commercial product development. The research exemption does not cover internal analytics activities, even if the company calls them 'research'.