Research Exemption under the DPDP Act: A Practical Guide for the Social Sector
Introduction
India’s Digital Personal Data Protection Act, 2023 (DPDP Act or Act), provides an exception to the application of the Act to processing of personal data1 necessary for research purposes, subject to fulfilment of certain conditions in the Act and Second Schedule of the Digital Personal Data Protection Rules, 2025 (DPDP Rules).
Social sector entities frequently conduct research in varied subject matters such as social sciences, education, medicine and science, which are undertaken (broadly speaking) either as standalone or pure research studies or studies based on existing programmes (e.g., measuring long term impact of programmes or research-based interventions). As on date, the DPDP Act or the DPDP Rules do not define ‘research’ and there are no detailed practical or statutory guidance on when and how to avail the research exemption under the Act.
In this article, we analyse what is likely to constitute a ‘research’ activity under the DPDP Act. In the absence of absolute legislative certainty, we also suggest some best practices and legally defensible procedures by which the research exemption can be availed by social sector entities. As Indian data protection law jurisprudence is yet to develop, we take guidance from committee reports, recent judgments and international data protection regulatory frameworks (where relevant) to set out some practical implementation measures.
What is ‘Research’?
Use in Indian legal context
The DPDP Act and the DPDP Rules do not define “research” and Indian law offers no general definition to fall back on, instead the term occasionally appears in sector specific regulations. The context and descriptions that do exist share one idea - research is an activity directed at extending knowledge.
The Income Tax Act, 1961 defines “scientific research” as “activities for the extension of knowledge in the fields of natural or applied science including agriculture, animal husbandry or fisheries”.2
The ICMR National Ethical Guidelines, define biomedical and health research as “studies on basic, applied and operational research designed primarily to increase the scientific knowledge about diseases and conditions (physical or socio-behavioral), their detection, cause and evolving strategies for health promotion, prevention, or amelioration of disease and rehabilitation including clinical research”.3
The B.N Srikrishna Committee Report on data protection, without defining the term, identified “the advancement of knowledge in public interest” as the thread linking research, archiving and statistics.4
More recently, the Hon’ble High Court of Delhi in ANI vs. OpenAI, in an interim order, referred to the dictionary meaning of ‘research’ i.e., “to study or investigate carefully” and “an investigation directed to the discovery of some fact by careful study of a subject; investigation, inquiry into things...”. The court ultimately held that training an LLM (large language model) is “a form of research”, the only limit being that it should be “at the behest of humans and for the benefit of humans”.5
International Frameworks
One of the developed guidance comes from the United Kingdom (UK). There, ‘scientific research’ covers any activity that “can reasonably be described as scientific”, whether publicly or privately funded and whether commercial or not.6 UK’s Information Commissioner’s Office (ICO) describes research as work that aims to advance a field, add to human knowledge, support education, or produce findings that others can test and replicate. It may be fundamental, applied or experimental development.7 The ICO expressly includes research that informs policy without being published, the development of artificial intelligence, and the secondary use of data. It also acknowledges that charities and commercial bodies, and not only public bodies, can conduct research. The ICO identifies research by its methods and by one key standard. The methods include designing studies, sampling populations, conducting surveys, analysing data and drawing inferences. The standard is that findings “do not lead directly to decisions about individuals”.8
Other jurisdictions apply similar tests. The US Common Rule requires “a systematic investigation … designed to develop or contribute to generalizable knowledge”.9 The European Data Protection Board looks for a methodical approach, ethical standards, verifiability, independence and a contribution to knowledge. It judges an activity by how it is conducted, not by its label.10 The EU General Data Protection Regulations also state that “the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research.” and “Scientific research purposes should also include studies conducted in the public interest in the area of public health.11
Singapore looks at purpose - its research exception covers exploratory work “that may not have any immediate application”. It requires a “clear public benefit” and that results are not used for decisions about individuals. Work that improves an organisation’s existing products falls under a separate business improvement exception, which cannot be used for marketing. 12 For AI, the research exception extends to “commercial research to advance the science and engineering without a product development roadmap”. 13
Read together, these sources point to some basic elements – and an activity can reasonably be treated as research under the DPDP Act where these elements are present:
(a) The activity must aim at extension of existing knowledge, generating insights capable of sector specific application and having a public interest or benefit. These elements apply to different areas of study such as social sciences, technological, historical, scientific, educational, economic, and medical research.
(b) There must be a defined research question or hypothesis, a research methodology, a design for collecting and analysing data, and a defined scope and study period. This is what separates research from general analysis.
(c) Research should be separate from routine operational processing – which does not become research automatically merely because it produces data or reports. Management information systems, programme monitoring and reporting to funders or government serve the operation and should be treated as operational processing.
(d) Research is not used to make decisions about individuals – this aspect is discussed in detail below.
We have sought to illustratively list some activities which will likely be (and not likely be) considered research for the purposes of DPDP Act in the Annexure to this article.
Availing the Research Exemption under DPDP Act: Practical Tools
Relying on research as a legitimate ground for processing of personal data provides considerable and wide-ranging exemptions from the DPDP Act and DPDP Rules (such as taking consent, issuing privacy notice, and rights of data principals) – therefore, it is important to ensure that the exemption is being availed in a compliant and legally defensible manner.
(a) Compliance with DPDP Act and DPDP Rules
Compliance with the provisions prescribed under the DPDP Act and DPDP Rules is a sine qua non to avail the research exemption legitimately. We discuss below the compliance requirements set out in the Act and Second Schedule of the DPDP Rules,14 their scope and address some practical challenges/queries which frequently come up:
(i) Processing of Personal Data should not be used to take any decision specific to a data principal15
Research outcomes are frequently used to inform/substantiate programme design, formulate or influence organisational policies, assess long term programme impact and identify areas where programmatic interventions may be required. It is reasonable to presume that such practical applications of research/research outcomes (and other similar high-level or broad-based applications) will be viewed as legitimate research objectives and will be permitted.16
The restriction on taking any specific decision to a data principal will be triggered if the research outcome is used to provide specific/customised or individualised services or decisions with respect to a Data Principal – for e.g., if outcome of a learning assessment educational research study is used to provide individualised support or customised curriculum for children who were found to be lagging behind in studies or their learning levels.
(ii) Personal data processing is carried out in a lawful manner
This condition is broad in scope to ensure that each processing activity performed on the personal data as part of research study is in compliance with law. Note that ‘processing’ is widely defined under the DPDP Act and any action that is performed on personal data will most likely be considered processing (e.g., storage, retrieval, indexing, erasure, sharing).
Therefore, if there are any other sectoral laws that are applicable to the personal data processing activity, then they must be followed – for example, ICMR guidelines must be followed for medical research studies or data localisation requirements under RBI regulations for payment data. Any IRB or ethics consent requirements also remain unaffected by the DPDP Act mandate. Organisations should assess the regulatory frameworks that will be applicable to their research activity upfront and put in place controls to ensure compliance.
(iii) Processing is for research purposes
We discussed above what activities will likely constitute research. It will be important to ensure that personal data originally collected for research is not subsequently used for other non-research or non-exempt purposes without going through the full DPDP compliance process. If there is likelihood of the same dataset being used for research and active operational/programmatic purposes or even individualised support, then it would be important to not rely solely on the research exemption and have the personal data processing be in compliance with DPDP Act and DPDP Rules.
(iv) Processing is limited to such personal data as is necessary for such uses or achieving such purposes (as the case may be)
This condition essentially imports the data minimisation principle into the research exemption. UK’s ICO provides a succinct guidance on data minimisation in the context of UK GDPR which is also helpful to consider in the context of the DPDP Act:
It must be ensured that the personal data being processed is:
- “Adequate – sufficient to properly fulfil your stated purpose;
- Relevant – has a rational link to that purpose; and
- Limited to what is necessary – you do not hold more than what you need for that purpose”
Organisations must therefore, as a starting point, identify the minimum amount of data that they need to fulfil the research purpose, articulate and document the rationale as to why this data is required for the stated research purpose and only collect that data. Excessive, unrelated or irrelevant personal data collected, with or without consent, will result in research exemption being incorrectly applied.
(v) Processing is done while making reasonable efforts to ensure the completeness, accuracy and consistency of personal data
The DPDP Act or DPDP Rules do not elaborate on what measures may constitute “reasonable efforts” to ensure completeness, accuracy and consistency of personal data. In practice, this will likely mean:
ensuring the source of data is reasonably reliable (appropriately using primary and secondary sources considering the outcomes/insights sought to be generated);
pre-empt challenges to completeness, accuracy and consistency of data in the organisation’s research context and building safeguards around it upfront; and
to consider whether it is necessary to periodically update or verify the personal data (this may be required where there is reliance on critical piece of personal data which is more susceptible to change than others).
The measures that need to be put in place can vary from study to study and will depend on the specific research context, sensitivity and volume of data handled.
(vi) Personal data is retained till required for such uses or achieving such purposes or for compliance with any law;
The obligations on retention and deletion of personal data that are applicable to personal data on other grounds of processing continue to apply to personal data being processed for research. If organisations wish to retain the dataset post conclusion of the research study, they can do so by anonymising the data set.
(vii) Reasonable security safeguards to prevent personal data breach to protect personal data in the possession or under control of the Data Fiduciary, including in respect of any processing undertaken by it or on its behalf by a Data Processor;
Processing personal data for research purposes does not exempt fiduciaries and processors from obligation to adopt reasonable security safeguards which apply to personal data processing on another grounds/basis.
Some measures which can be considered are:
to carry out data protection impact assessment before commencing the research study;
taking a ‘data protection by design and default’ approach in processing activities, adopt encryption measures, share data only through official channels like email (and not through informal messaging apps such as WhatsApp or Slack); and
pseudonymise the data set ascribing unique IDs.
The access to the ‘key’ with the link to personal data can be restricted to a limited group of people working on the study – and the larger group may be given access to the de-identified dataset. If there are field workers responsible for collecting data on ground, they should be trained in handling personal data and sign non-disclosure agreements with adequate data protection clauses. If the research finding is sought to be published, then the dataset should be stripped of personal data i.e., identifiable information before publication.
(viii) Accountability of the person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, for effective observance of these standards.
This provision ascribes accountability for data fiduciary or fiduciaries (if more than one) for the personal data that they process for research purposes. Organisations should ensure that data owners of the research study are defined and compliance of data processors is ensured through comprehensive data processing agreements.
(b) Public interest/benefit of the research study
While public interest as a condition for research is not explicitly built in the DPDP Act, where possible, articulating and documenting public interest/benefit of a research study builds legal defensibility for the purposes of the DPDP Act. Examples of public interest may include - developing knowledge-based policy, identifying correlations between socio-economic factors to make informed programmatic or policy interventions, advancing biological or medical research for preventing or curing diseases, improving quality of life, improving delivery or access of social services or technology to underserved sections of population, and technological advancement with broad based public interest applications. Providing an option to access the research dataset (on an anonymised basis) to independent or affiliated researchers who apply can also showcase an enduring public benefit.
(c) Documentation as a compliance tool
Organisations may formulate internal research guidelines or policies which will document:
how the organisation differentiates between research activities and their usual programmatic or operational activities, including the rationale/reasoning it applies and the public interest/benefit expected from the research outcome;
the review process – the personnel/group in the organisation who will review the research proposal and decide applicability of DPDP Act (ensuring that the data protection officer or in-house legal teams are part of the review process);
the security and safeguard measures that are applied to data collected for research purposes;
- anonymisation or pseudonymisation measures applied on the data; and
- other measures that the organisation adopts to ensure compliance with the DPDP Act and DPDP Rules conditions discussed in (a) above.
For each research study, it is important to document a statement on personal data protection (the format of which can be flexible) which will confirm that the organisation’s internal processes on collection of personal data for research were followed and articulate why the study was categorised as research under the DPDP Act and the grounds on which DPDP Act research exemption is being availed.
Guidelines/policies such as these helps in standardising process and compliance for the organisation and builds legal defensibility. Organisations can start putting in place these policies and need not wait for the substantive provisions of the DPDP Act to come into force. Organisations should be mindful about selecting programmes that apply for the research exemption and it should not appear that the exemption is being exploited to avoid applicability of the DPDP Act.
(d) Research in collaboration with partner organisations
Collaboration for research purposes with partner organisations may be undertaken in different forms. It can be in form of commissioned research wherein the implementing organisation commissions research on its own programme. It can also be undertaken as independent research wherein an external organisation uses programme data but sets its own agenda and methods.
In any such collaboration, organisations should first determine the fiduciary – processor relationship between entities which would depend on which entity is setting the means and purpose of personal data collection (i.e., the data fiduciary), whether entities have the flexibility to set their own agenda and data processing purposes (in which case both entities will be the data fiduciary) or does one organisation simply follow the instructions given by the other (the entity following the instruction will be the data processor and entity giving instruction, the data fiduciary). The relationship then informs the roles and responsibilities of entities under the data processing or sharing agreement.
Going forward, it is important to enter into data processing or sharing agreements with research partners so that the scope of processing of personal data is limited to research purposes and the DPDP Act compliance (discussed in (a)) is adhered to by all entities involved. The scope of work under the service agreement (or any other agreement) entered into with the partner organisation should also be aligned with the data processing mandate under the data processing or sharing agreements.
(e) Research under Government MOUs
If the research study (or generally the programme) is being conducted in collaboration with the government or with the sanction of the government under an MOU or using data from government databases – note that it does not automatically exempt organisations from DPDP Act compliance.
The compliance obligation (re data protection) must be determined basis the specific scope and wording of the MOU using the following indicative questions:
does the MOU extend any exemptions/relaxations to the organisation (the exemption must be explicit and not presumed)?
Is the MOU silent on data protection or contain a general clause on compliance with laws?
In which case it is likely that the DPDP Act compliances continue to apply and must be followed as is.
Annexure- Research Activities
Activities that will likely constitute research (subject to other compliances discussed above)
Activity |
Longitudinal study tracking the programme impacts of the same cohort/ beneficiaries over several years |
Baseline and endline surveys conducted as part of a time-bound evaluation study |
Process or implementation research on how a programme is delivered in different settings |
Validation of an assessment tool (for example, testing the reliability of a reading or arithmetic test) |
Secondary analysis of programme data to answer a defined research question |
Qualitative research such as interviews, focus group discussions or case studies with a defined research design |
Impact evaluation – whether conducted by donor or by organisation if broad based to identify socio-economic indicators impacting programme efficacy/delivery |
Activities that will not constitute research
Activity |
Routine MIS, attendance records, programme dashboards and monitoring |
Reporting to donors, CSR partners or government, including utilisation and compliance reports |
Assessing a beneficiary’s information in order to decide the support they receive |
Case management, grievance handling |
Fundraising and donor profiling |
Beneficiary stories, photographs or testimonials used in communications and fundraising |
Notes
Digital Personal Data Protection Act, 2023, § 2(t) (India). The Act defines “personal data” as any data about an individual who is identifiable by or in relation to such data.
Income-tax Act, 1961, § 43(4)(i) (India). Note, however, that the defined term does not appear in the new Income-tax Act, 2025. Section 45 of the Income Tax Act, 2025 does provide the same deduction for scientific research but only defines it in limited contexts. It also leaves open the question of determining what amounts to “scientific research” to the Central Government or a designated authority.
Indian Council of Medical Research. (2017). National ethical guidelines for biomedical and health research involving human participants (Glossary). https://ethics.ncdirindia.org/asset/pdf/ICMR_National_Ethical_Guidelines.pdf
Committee of Experts under the Chairmanship of Justice B. N. Srikrishna. (2018). A free and fair digital economy: Protecting privacy, empowering Indians (Ch. 8, Pt. IV, pp. 137–138). Ministry of Electronics and Information Technology, Government of India.
ANI Media Pvt. Ltd. v. OpenAI OpCo LLC, CS(COMM) 1028/2024 (Del. HC 24 July 2026), paras. 212–218. http://indiankanoon.org/doc/93327052/
Data (Use and Access) Act 2025, c. 18, § 67 (UK) (inserting a definition of scientific research into Art. 4 of the UK GDPR). https://www.legislation.gov.uk/ukpga/2025/18/section/67
Information Commissioner’s Office. (n.d.-b). What is research-related processing? In Guidance on the research provisions (section “What is scientific or historical research?”). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/the-research-provisions/what-is-research-related-processing/ The three forms of research follow the categories in OECD. (2015). Frascati manual 2015: Guidelines for collecting and reporting data on research and experimental development. OECD Publishing.
Information Commissioner’s Office (n.d.-b), section “What are some indicative criteria for scientific or historical research?”.
Protection of Human Subjects, 45 C.F.R. § 46.102(l) (2018). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46/subpart-A/section-46.102
European Data Protection Board. (2026). Guidelines 1/2026 on the processing of personal data for scientific research purposes (adopted 15 April 2026). For a summary, see Ropes & Gray LLP. (2026, April). https://www.ropesgray.com/en/insights/alerts/2026/04/the-european-data-protection-board-releases-new-guidelines-on-the-processing-of-personal-data
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation), 2016 O.J. (L 119) 1. https://gdpr-info.eu/recitals/no-159/
Personal Data Protection Act 2012, Second Schedule, Pt. 2, Divs. 2–3, and First Schedule, Pt. 5 (Singapore); Personal Data Protection Commission. (2021, February 1). Advisory guidelines on key concepts in the Personal Data Protection Act (Annex A). https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/AG-on-Key-Concepts/Annex-A--PDPAs-Framework-for-the-Collection-Use-and-Disclosure-of-Personal-Data-1-Feb-2021.pdf
Personal Data Protection Commission. (2024, March 1). Advisory guidelines on the use of personal data in AI recommendation and decision systems (para. 4.2(b)). https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf
Digital Personal Data Protection Act, 2023, § 17(2)(b) (India), read with Digital Personal Data Protection Rules, 2025, r. 16 and Second Schedule (India).
A data principal is the individual (natural person) to whom the personal data relates. See Digital Personal Data Protection Act, 2023, § 2(j) (India).
The Information Commissioner’s Office provides similar guidance in the context of the UK GDPR. See Information Commissioner’s Office. (n.d.-a). What are the appropriate safeguards? In Guidance on the research provisions. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/the-research-provisions/what-are-the-appropriate-safeguards/#individuals
Comments