Digital Personal Data Protection Act 2022/23 of India

CHAPTER IV

Special Provisions

17. Processing of personal data outside India

(1) A Data Fiduciary may, unless restricted by the Central Government by notification upon the assessment of such factors as it may consider necessary, transfer personal data for processing to any country or territory outside India in accordance with such terms and conditions as the Central Government may notify.

(2) Nothing in this section shall restrict the applicability of any law for time being in force in India that provides for a higher degree of protection for or restriction on transfer of personal data by a Data Fiduciary outside India in relation to any personal data or Data Fiduciary or class thereof which may be provided for under that law

18: Legitimate Purposes

(1) The provisions of Chapter II, except subsections (1) and (5) of section 9, and those of Chapter III and section 17 shall not apply where—

(a) the processing of personal data is necessary for enforcing any legal right or claim;

(b) the processing of personal data by any court or tribunal or any other body in India which is entrusted by law with the performance of any judicial or quasijudicial or regulatory or supervisory function, where such processing is necessary for the performance of such function;

(c) personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India;

(d) personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India

(e) the processing is necessary for a scheme of compromise or arrangement or merger or amalgamation of two or more companies or a reconstruction by way of demerger or otherwise of a company, or transfer of undertaking of one or more company to another company, or involving division of one or more, approved by a court or tribunal or other authority competent to do so by law for the time being in force; and

(f) the processing is for the purpose of ascertaining the whereabouts, financial information and assets and liabilities of any person from whom a claim is due against a debt owed by her, subject to such processing being in accordance with the provisions regarding disclosure of information or data in any other law for the time being in force.

(2) The application of provisions of this Act shall be exempt in respect of the processing of personal data—

(a) by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these, and the processing by the Central Government of any personal data that such instrumentality may furnish to it; and

(b) necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with standards specified by the Central Government by notification.

Explanation.—For the purposes of this subsection, the term “State” shall have the meaning assigned to it in article 12 of the Constitution.

(3) The Central Government may by notification, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or class of Data Fiduciaries, including startups, as Data Fiduciaries to whom the provisions of section 6, sub-sections (3) and (7) of section 9, sub-sections (1) and (3) of section 10, and sections 11 and 12 of this Act shall not apply.

Explanation 1.—For the purposes of this subsection, the term “startup” means a private limited company or a partnership firm or a limited liability partnership incorporated in India, which is eligible to be and is recognised as such in accordance with the criteria and process notified by the department to which matters relating to start-ups are allocated in the Central Government

Explanation 2.—It is hereby clarified that the classes of Data Fiduciaries shall be such as may be specified while prescribing.

(4) The provisions of sub-section (7) of section 9 and sub-section (3) of section 13 of this Act shall not apply in respect of processing by the State or any instrumentality of the State.

Explanation.—For the purposes of this subsection, the term “State” shall have the meaning assigned to it in article 12 of the Constitution

(5) The Central Government may, before expiry of five years from the date of commencement of this Act, declare by notification that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification.

Explanation.—It is hereby clarified that the classes of Data Fiduciaries shall be such as may be specified while prescribing.

18. Exemptions.

(1) The provisions of Chapter 2 except sub-section (4) of section 9, Chapter 3 and Section 17 of this Act shall not apply where:

(a) the processing of personal data is necessary for enforcing any legal right or claim;

(b) the processing of personal data by any court or tribunal or any other body in India is necessary for the performance of any judicial or quasi-judicial function;

(c) personal data is processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law;

(d) personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India.

(2) The Central Government may, by notification, exempt from the application of provisions of this Act, the processing of personal data:

(a) by any instrumentality of the State in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these; and

(3) The Central Government may by notification, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or class of Data Fiduciaries as Data Fiduciary to whom the provisions of Section 6, sub-sections (2) and (6) of section 9, sections 10, 11 and 12 of this Act shall not apply.

(4) The provisions of sub-section (6) of section 9 of this Act shall not apply in respect of processing by the State or any instrumentality of the State.