Research and statistical processing exemptions have conditions

Imagine an analytics team naming a new folder “research” and assuming the customer data inside it is exempt from DPDP. The label is easy to create. The exemption requires a more specific assessment.

Section 17(2)(b) concerns processing necessary for research, archiving or statistical purposes, where the personal data will not be used to take a decision specific to a Data Principal and the processing follows prescribed standards. These conditions belong together. A useful project description addresses each one rather than treating a broad research objective as sufficient.

As at 22 October 2026, this substantive framework and the relevant standards are scheduled to commence on 13 May 2027 under the Act commencement notification and rule 1(4). The discussion supports readiness for that phase; it does not remove obligations under other applicable laws or contracts.

Explain what the project is trying to learn

Consider a hypothetical delivery company studying average delivery times across districts. Its research question concerns patterns across routes. A separate team wants to use customer-level records to decide which individual customers should receive a slower service or a higher charge.

Those are different uses even if they start from the same dataset. The exemption’s condition concerning decisions specific to a Data Principal makes the distinction material. The company should map who receives the data and outputs, not merely describe the analyst’s initial intention.

Write the question, expected output, intended audience and prohibited downstream uses. If the proposal is actually a customer-scoring feature, assess that activity on its own terms. Calling model training or product optimisation “research” does not settle the statutory test.

Necessity is a data-selection question

The hypothetical study may need delivery timestamps, route categories and broad geographic areas. It may not need customers’ names, full addresses or free-text complaints containing family details. Explain the relationship between each retained field and the research purpose.

The Second Schedule includes limitation to personal data necessary for the specified use or purpose. It also requires lawful processing and reasonable efforts concerning completeness, accuracy and consistency. A large historical export should not become the default simply because the analyst can access it.

A practical review can compare a reduced dataset with the proposed full dataset. If the reduced version answers the research question, record why the additional fields were excluded. If a more detailed field is genuinely needed, identify the reason and the control that limits exposure. This is a suggested assessment method, not a prescribed statutory form.

Prescribed standards still involve real controls

Rule 16 and the Second Schedule supply the relevant standards. They address retention for the required purpose or legal compliance, reasonable security safeguards, processing performed through processors, and accountability of the person determining purpose and means.

For the delivery study, define who can access working data, where it is stored and when identifiable working files will be removed. Review the provider if an outside analyst or hosted platform processes the information. An exemption should not be used as a reason to distribute unrestricted copies.

The Schedule also contains a particular intimation and contact-information clause for processing under section 7(b). Read that condition carefully. It should not be described as an identical notice requirement automatically imposed on every research project through section 17(2)(b).

Protect the boundary after the analysis

A project can change after approval. Suppose the delivery study produces a table that still identifies individual customers. A commercial team then asks to use that table to prioritise those people. The original research assessment cannot simply be carried across to the new purpose.

Build a review trigger for new recipients, linked datasets, person-level outputs and decisions about individuals. Consider whether the project can provide aggregate outputs that answer the legitimate research question without enabling the proposed individual use. Review small groups and unusual combinations carefully; removing names alone does not establish that people cannot be identified.

Keep the output specification with the project record. A recipient should understand what the results may be used for and when another assessment is required. Technical access restrictions can help enforce the boundary where the organisation has suitable systems.

Keep an assessment someone can challenge

The project owner should be able to explain the statutory purpose, necessity, absence of individual-specific decisions and observance of the prescribed standards. Include unresolved questions and who will decide them. A declaration that the work is “for research only” is weak if actual access and downstream decisions tell another story.

The failure to avoid is treating an exemption as a permanent attribute of a dataset. Reliance concerns processing under defined conditions. When the purpose or use changes, the assessment needs to change with it.