The State's exemptionis not your exemption.

Exemptions are notified, specific and narrow. Assumptions are none of those.

In one line: DPDPA applies to the State, but Section 17(2)(a) lets the Central Government exempt notified instrumentalities in specified interests such as sovereignty, security and public order.

The estate · Government vendorsHover to inspect

Read the notification. Then read your contract. Then read them again.

The scene

The vendor's compliance note said ‘Government client, DPDPA not applicable’. It had been copied from a deck. Nobody had read the notification, because none had been issued for that department.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
All government work is exempt. Section 17(2)(a) applies only to instrumentalities the Government notifies, for stated interests. Check whether a notification exists and what it covers.
If the department is exempt, so are we. Your own processing and your own staff data remain in scope. Separate the department's position from yours.

Contracts are catching up

Government contracts increasingly include data protection terms regardless of exemptions. The vendor that already meets them is the vendor that renews.

Monday morning

  1. 01List every government contract involving personal data.
  2. 02Check for any exemption notification.
  3. 03Brief delivery teams on what applies regardless.

Questions, answered plainly

Does DPDPA apply to government departments?

DPDPA applies to the State, but Section 17(2)(a) lets the Central Government exempt notified instrumentalities in specified interests such as sovereignty, security and public order.

Are private vendors covered by government exemptions?

Not automatically. The scope depends on the notification. Vendors should assume DPDPA applies to their own processing and contract accordingly.

Sector · Government vendorsThe State's exemption is not your exemption.Read → Government vendors · Deep diveThe contract ended. The citizens' data did not.Read → Government vendors · Deep diveReal citizens in test data.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner