India’s Digital Personal Data Protection Act, 2023 (DPDPA), imposes uniform data protection obligations across sectors, significantly affecting healthcare, pharma, and biotech firms due to their use of sensitive personal data. Section 17(2)(b) provides limited exemptions for “research, archiving, or statistical purposes,” which some stakeholders interpret as broad immunity.
This article challenges that view, arguing that Indian policy generally restricts exemptions for private, profit-driven research unless a clear public interest is demonstrated. Drawing on parallels with the GDPR, it concludes that the exemption will likely be narrowly construed, and the forthcoming DPDPA Rules are unlikely to support a wide carve-out.
