Rule 16 — DPDP Rules, 2025
Processing of personal data for research, archiving or statistical purposes shall be exempt from the provisions of this Act to the extent that the processing complies with the standards specified in the Second Schedule. Second Schedule standards include: (a) personal data shall not be used for any purpose other than research, archiving or statistical purposes; (b) personal data shall be de-identified to the extent reasonably practicable; (c) research results shall not be published in a form that identifies any Data Principal; (d) appropriate security safeguards shall be in place; (e) personal data shall not be transferred outside India except in accordance with the provisions of this Act.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 16 and the Second Schedule set the conditions for the research exemption. Calling an activity 'research' is not sufficient — the processing must meet all Second Schedule standards simultaneously. The most important constraints are that research data cannot be re-used for commercial purposes, results cannot identify individuals, and de-identification must be applied to the maximum extent practicable. Academic research, public health studies, and government statistical surveys that genuinely meet these standards can benefit from the exemption.
A university public health department processes de-identified patient records from partner hospitals to study disease prevalence patterns. Results are published in aggregate, no individual is identified, data is not used commercially, and it is deleted after the study concludes. This meets the Second Schedule standards.
An e-commerce company's 'research team' analyses purchase data to optimise product recommendations. This is commercial product development — it uses personal data for a commercial purpose and the results benefit the company commercially. The research exemption does not apply.