State Exemptions Under The Digital Personal Data Protection Act, 2023: Testing Section 17(2)(A) Against The Proportionality Standard
- IJLLR Journal
- Jul 8
- 1 min read
Yash Verma, Advocate, Delhi High Court
ABSTRACT
The Digital Personal Data Protection Act, 2023 builds its architecture around consent, yet Section 17 carves out exemptions that sit uneasily with that architecture. Among these, Section 17(2)(a) stands apart. It allows the Central Government to exempt any instrumentality of the State from the whole of the Act, not merely from specific chapters, on grounds such as sovereignty, security, and public order, through nothing more than an executive notification. This paper examines whether that power survives the proportionality standard laid down in Justice K.S. Puttaswamy v Union of India and refined in later decisions such as Anuradha Bhasin v Union of India. It argues that Section 17(2)(a) fails at the standard's third and fourth limbs, it dispenses with any calibrated, least-intrusive design, and it builds in no procedural safeguard against misuse, unlike the framework the Supreme Court itself read into telephone tapping law in PUCL v Union of India. The paper situates this gap within the institutional design of the Data Protection Board of India, whose Chairperson and Members are selected entirely through executive-controlled committees, and argues that this makes correction more urgent, not less. Drawing a comparison with Article 23 of the GDPR and India's own precedent in PUCL, the paper closes with concrete proposals, a defined class of instrumentality, a sunset clause, and a recorded-reasons requirement, all of which the Rules notified in November 2025 currently omit.
Keywords: Digital Personal Data Protection Act; Section 17; State exemptions; proportionality standard; right to privacy; Data Protection Board of India.
