Section 17 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The last two sub-sections of section 17 do two different things. Sub-section (4) relaxes three duties when the State or its instrumentalities process personal data. Sub-section (5) gives the Central Government a time-limited power: before five years from commencement of the Act, it may notify that any provision shall not apply to specified Data Fiduciaries for a specified period. For advice on how these affect your dealings with government bodies, consider a legal consultation.
Section 17(4): where the State or an instrumentality of the State processes personal data, section 8(7) (erasure) and section 12(3) (erasure on request) do not apply, and section 12(2) (correction, completion, updating) does not apply where the purpose does not include a decision that affects the Data Principal. Section 17(5): before expiry of five years from the date of commencement, the Central Government may, by notification, declare that any provision of the Act does not apply to specified Data Fiduciaries or classes, for a period specified in the notification.
Section 17(4): State processing
The text: "In respect of processing by the State or any instrumentality of the State, the provisions of sub-section (7) of section 8 and sub-section (3) of section 12 and, where such processing is for a purpose that does not include making of a decision that affects the Data Principal, sub-section (2) of section 12 shall not apply."
| Provision | Content | Applies to State processing? |
|---|---|---|
| Section 8(7) | Fiduciary must erase data on withdrawal of consent or when the specified purpose is no longer served, unless retention is necessary for compliance with law; processors to erase too | No |
| Section 12(3) | Data Principal may request erasure; fiduciary must erase unless retention is necessary for the specified purpose or for legal compliance | No |
| Section 12(2) | On request, correct inaccurate or misleading data, complete incomplete data and update data | No, only where the purpose does not include a decision affecting the Data Principal; otherwise it applies |
| All other provisions | Notice, security, breach, grievance, rights of access and nomination and so on | Continue, unless another exemption applies |
Points to note.
- "State" means article 12 of the Constitution (section 2(zb)), and instrumentalities are included. The Act does not list which bodies qualify.
- The relief is narrow. It is about erasure and correction. A State body that uses personal data to decide on a benefit, licence or service must still keep the data accurate, because the correction duty applies where the purpose includes a decision that affects the Data Principal.
- The security duty and breach intimation remain. A State body's database breach still engages sections 8(5) and 8(6), subject to other exemptions and to section 17(2)(a) for notified security instrumentalities.
- It operates alongside the legitimate uses in section 7, which allow State processing for subsidies, benefits, services and functions without consent. See section 7(b).
A private company working for the State does not get this relief merely by being a contractor. The sub-section speaks of processing "by the State or any instrumentality of the State". Whether a contractor is covered is not answered by the text; the fiduciary remains responsible under section 8(1) for its processors.
Section 17(5): the five-year power
The text: "The Central Government may, before expiry of five years from the date of commencement of this Act, by notification, declare that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification."
Its features:
- Any provision. Unlike sub-sections (2) and (3), there is no list; the Government can name any provision.
- Time-limited power. The notification must be made before five years from commencement. Section 1(2) lets the Central Government appoint different dates of commencement for different provisions, and the Act does not say from which date the five years run when dates differ. Check the commencement notifications and the Rules.
- Period specified. The notification itself states how long the relief lasts. The Act does not cap that period, and it does not say whether the period may run beyond the five-year window.
- Applies to specified fiduciaries or classes. It is not a blanket for everyone.
- No stated criteria. Unlike section 17(3), it does not mention volume or nature of data. The Act does not say what factors the Government must consider.
- Laying before Parliament. Section 41 covers rules and notifications under sections 16 and 42 only; the Act does not mention a section 17(5) notification there.
Compare with section 17(3)
| Feature | Section 17(3) | Section 17(5) |
|---|---|---|
| Provisions that can be disapplied | Section 5, 8(3), 8(7), 10, 11 | Any provision |
| Criteria in the text | Volume and nature of data | None stated |
| Time limit on power | None stated | Before five years from commencement |
| Duration of relief | Not stated | As specified in the notification |
See section 17(3) for the narrower power.
What this means for compliance planning
- Plan for the full Act. A power to exempt is not an exemption. Until a notification names your entity or class, assume the provision applies.
- Watch the notifications. Keep a register of notifications that mention your sector and check its date and period.
- Do not build a strategy on hoped-for relief. The power may be used or not.
- For State bodies, separate datasets used for decisions from those that are not, because the correction duty depends on that distinction.
- For vendors to State bodies, your contract should say which party does what on correction and erasure, since section 17(4) speaks of the State's processing.
Example
A State agency maintains a register of applicants for a public scheme, and uses it to decide eligibility. The agency need not erase the data on request under section 12(3), and section 8(7) does not compel erasure. But since the purpose includes a decision affecting the applicant, section 12(2) applies and the agency must correct inaccurate data when asked.
What the two sub-sections do not say
- Sub-section (4) does not exempt the State from the Act generally. For that, see section 17(2)(a).
- Sub-section (5) does not say that a notification overrides the Board's powers to inquire into other provisions.
- Neither sub-section says anything about appeal against a notification.
Need help reading exemptions for your organisation?
Whether you deal with State bodies or may be named in a future notification, the safest course is to know which obligations sit with you today. Our legal consultation team can help you identify them and plan the contract and record changes.
Key takeaways
- Section 17(4) relieves State processing from sections 8(7) and 12(3), and from 12(2) where no decision affects the Data Principal.
- Section 17(5) lets the Central Government disapply any provision for specified fiduciaries before five years from commencement.
- The period of relief is set in the notification.
- Neither sub-section is self-executing or automatic for private bodies.
- Security and breach duties remain for State processing.
Read next
- Section 17(3): startups and notified Data Fiduciaries
- Section 17(2): State security, research and statistics
- Section 12 of the DPDP Act, 2023: right to correction and erasure
- Section 8 of the DPDP Act, 2023: erasure and retention of personal data
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.