/The Rules · 2025
Rule 16: Exemption from Act for research, archiving or statistical purposes
DPDP Rules, 2025, G.S.R. 846(E) dated 13 November 2025. Comes into force on 13 May 2027.
- Provision
- Rule 16 of The Digital Personal Data Protection Rules, 2025
- Status
- Comes into force on 13 May 2027 (phase 3)
- Made under
- s. 17 Exemptions
- Schedules referenced
- Second Schedule
- Source
- Ministry of Electronics and Information Technology · G.S.R. 846(E) · 13 November 2025 · Official PDF
The provisions of the Act shall not apply to the processing of personal data necessary for research, archiving or statistical purposes if it is carried on in accordance with the standards specified in Second Schedule.
Rule 16 provides an exemption from the Digital Personal Data Protection Act for certain types of data processing. If personal data is processed specifically for research, archiving, or statistical purposes, the standard rules of the Act do not apply. However, this exemption is not automatic or absolute. To qualify for it, the processing must be strictly necessary for those specific purposes. Additionally, the processing must follow the exact standards that are set out in the Second Schedule of the rules. If those standards are not met, the exemption does not apply.
Key points
- The provisions of the Act do not apply to processing personal data for research, archiving, or statistical purposes.
- The processing must be necessary for these specific purposes to qualify for the exemption.
- The processing must be carried out in accordance with the standards specified in the Second Schedule.
Common misreadings
- Assuming that any research or statistical work automatically exempts the processing from the Act, when it actually must follow the standards specified in the Second Schedule.
Interpretation prepared from the official text only, 9 September 2026. The official text above prevails.
/MYND · DPDP practice
Putting this into practice?
MYND runs DPDP compliance programmes for the data that flows through HR, payroll, finance and vendor operations: readiness assessments, consent and notice design, processor contracts and breach playbooks. Tell us what you are working on and a compliance lead will reply within one working day.