Section 17 Exemptions
- Chapter
- IV · Special Provisions
17. (1) The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where-
(a) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is necessary for enforcing any legal right or claim;
(b) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasi-judicial or regulatory or supervisory function, where such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is necessary for the performance of such function;
(c) personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India;
(d) personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Principals not within the territory of India is processed pursuant to any contract entered into with any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses outside the territory of India by any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses based in India;
(e) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more companies, approved by a court or tribunal or other authority competent to do so by any law for the time being in force; and
(f) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is for the purpose of ascertaining the financial information and assets and liabilities of any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses who has defaulted in payment due on account of a loan or advance taken from a financial institution, subject to such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... being in accordance with the provisions regarding disclosure of information or dataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means in any other law for the time being in force.
Explanation.-For the purposes of this clause, the expressions "default" and "financial institution" shall have the meanings respectively assigned to them in sub-sections (12) and (14) of section 3 of the Insolvency and Bankruptcy Code, 2016.
Illustration
X, an individual, takes a loan from Y, a bank. X defaults in paying her monthly loan repayment instalment on the date on which it falls due. Y may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X for ascertaining her financial information and assets and liabilities.
(2) The provisions of this Act shall not apply in respect of the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal data-
(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... by the Central Government of any personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data that such instrumentality may furnish to it; and
(b) necessary for research, archiving or statistical purposes if the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is not to be used to take any decision specific to a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is carried on in accordance with such standards as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(3) The Central Government may, having regard to the volume and nature of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data processed, notify certain DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries or class of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries, including startups, as DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries to whom the provisions of section 5, sub-sections (3) and (7) of section 8 and sections 10 and 11 shall not apply.
Explanation.-For the purposes of this sub-section, the term "startup" means a private limited company or a partnership firm or a limited liability partnership incorporated in India, which is eligible to be and is recognised as such in accordance with the criteria and process notified by the department to which matters relating to startups are allocated in the Central Government.
(4) In respect of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... by the State or any instrumentality of the State, the provisions of sub-section (7) of section 8 and sub-section (3) of section 12 and, where such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... is for a purpose that does not include making of a decision that affects the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, sub-section (2) of section 12 shall not apply.
(5) The Central Government may, before expiry of five years from the date of commencement of this Act, by notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly, declare that any provision of this Act shall not apply to such Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data or classes of DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Fiduciaries for such period as may be specified in the notificationDefined in section 2(r): notification means a notification published in the Official Gazette and the expressions notify and notified shall be construed accordingly.