Can DPDPA's Research Exemption Power Private Sector Breakthroughs?

India's Digital Personal Data Protection Act, 2023 (DPDPA), imposes uniform data protection obligations across sectors, significantly affecting healthcare, pharma, and biotech firms due to their use of sensitive personal data. Section 17(2) (b) provides limited exemptions for "research, archiving, or statistical purposes," which some stakeholders interpret as broad immunity.

- 

This article challenges that view, arguing that Indian policy generally restricts exemptions for private, profit-driven research unless a clear public interest is demonstrated. Drawing on parallels with the GDPR, it concludes that the exemption will likely be narrowly construed, and the forthcoming DPDPA Rules are unlikely to support a wide carve-out.

The Digital Personal Data Protection Act, 2023 (DPDPA) is a law that primarily affects and benefits people and organisations that deal with personal data.

From tech giants to hospitals, from law firms to educational boards, the law places clear obligations on all those processing personal data. Healthcare, pharma, and biotech companies are no exception. While much attention has been drawn to how social media companies are affected, the impact on healthcare, pharma, and biotech sectors has not been adequately analysed.

Many such companies believe that the research exemption under Section 17(2)(b) of the DPDPA will save them from onerous compliance. But that belief may be flawed. In this article, we explain why.

The regulatory intent behind Sec. 17(2)(b) of DPDPA

Section 17(2)(b) allows personal data use for research, archiving, or statistics, if not tied to individuals and done per government norms.

It reads as:

- ‘(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.’

The “standards as may be prescribed” have not yet been prescribed, which means the exemption is not yet live. The rules for the DPDPA will propose standards and give other clarifications regarding the clause.

The direction of India’s public policy