Section 17 — DPDP Act, 2023
(1) The Central Government may, having regard to the sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, or preventing incitement to the commission of any cognisable offence, by notification, exempt any Data Fiduciary or class of Data Fiduciaries from the application of all or any of the provisions of this Act. (2) The Central Government may, by rules, exempt any instrumentality of the State from the application of all or any of the provisions of this Act for purposes relating to— (a) the sovereignty and integrity of India; (b) security of the State; (c) friendly relations with foreign States; (d) maintenance of public order; (e) prevention, detection, investigation or prosecution of offences.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 17 creates the national security and public order exemption — it allows the Central Government to exempt Data Fiduciaries or government instrumentalities from Act provisions where national security or public order interests are at stake. The exemption requires a government notification and is not self-applying. For commercial organisations, Section 17 is unlikely to be relevant unless they receive a government direction under it. For government agencies and their contractors, the Section 17 exemptions may materially alter their compliance obligations.
Section 17 does not make all government data processing exempt from the DPDP Act. Only government instrumentalities processing data for the specific purposes listed (security, public order, foreign relations, etc.) and covered by a government notification or rule are exempt. Regular government service delivery processing falls under Chapter II's obligations.