The State's exemptionis not your exemption.

Government may be exempted by notification. The vendor running its systems usually is not.

In one line: Section 17(2)(a) lets the Central Government exempt notified instrumentalities of the State in specified interests. It does not automatically exempt private vendors, and the scope of any exemption depends on the notification.

The estate · Government vendorsHover to inspect

You hold the citizen's data. You hold the citizen's risk.

The scene

The contractor ran a state scheme's beneficiary portal. Millions of records: names, bank accounts, identity numbers, caste certificates. The department assumed the vendor was secure. The vendor assumed the department's exemption covered it.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Government work is exempt. Section 17(2)(a) exempts notified instrumentalities of the State; vendors are not automatically covered. Read the notification. Then read your contract.
The department sets the rules. As processor you still need safeguards; as fiduciary for your own purposes you carry the Act directly. Know which role you play in each system.
Public data isn't personal data. Beneficiary data is personal data of citizens. Protect it as though your name were on it. It often is.

Contracts decide

Government tenders are adding data protection clauses. The vendor that can evidence safeguards, breach readiness and deletion at contract end is the one that renews.

The full Government vendors briefing

3 deep dives
Deep dive 01→

The State's exemption is not your exemption.

Read the notification. Then read your contract. Then read them again.
Deep dive 02→

The contract ended. The citizens' data did not.

Handover is not finished until the last copy is gone.
Deep dive 03→

Real citizens in test data.

Test data is not fake just because the server is.

Monday morning

  1. 01List every government system you run that holds personal data.
  2. 02Confirm in writing who is fiduciary for each.
  3. 03Plan data return and deletion at contract end.

Questions, answered plainly

Does the government exemption under DPDPA apply to contractors?

Section 17(2)(a) lets the Central Government exempt notified instrumentalities of the State in specified interests. It does not automatically exempt private vendors, and the scope of any exemption depends on the notification.

Are government IT vendors Data Processors under DPDPA?

Where they process personal data on a department's instructions, they generally act as Data Processors. Where they use the data for their own purposes, they may be Data Fiduciaries.

Sector · Banking & BFSIBanks keep everything. The law now asks why.Read → Sector · Fintech & NBFCYour onboarding takes ninety seconds. Your liability lasts years.Read → Sector · Healthcare & PharmaThe Act has no 'sensitive' category. Your patients do.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner