The DPDP Act and GIFT IFSC: Understanding the Section 17(1)(d) Exemption

A significant part of GIFT IFSC’s service economy involves processing personal data for offshore clients, whether through fund administration, global in-house centres or back-office operations. Section 17(1)(d) of the Digital Personal Data Protection Act, 2023 provides an exemption for certain activities involving data of individuals outside India, subject to specific conditions. Understanding the scope of the DPDP Act exemption for GIFT IFSC, its limitations and when the remaining compliance obligations take effect is important for businesses handling personal data in the IFSC.

The Provision

Section 17(1) of the DPDP Act provides that the provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16, shall not apply where, under clause (d):

“personal data of Data Principals not within the territory of India is processed pursuant to any contract entered into with any person outside the territory of India by any person based in India”.

The conditions are cumulative. The data principals must not be within the territory of India, the processing must be pursuant to a contract with a person outside India, and it must be undertaken by a person based in India, which an IFSC unit will ordinarily be. In practice the first two conditions are where disputes arise.

Chapter II contains the core obligations of data fiduciaries, including notice, consent, purpose limitation, security safeguards, breach notification and the obligations of significant data fiduciaries. Chapter III contains the rights and duties of data principals. Section 16 restricts transfer of personal data outside India to countries or territories restricted by the Central Government. The exemption is therefore substantial where it applies, but it is not total. Two provisions of Chapter II are expressly carved out of it and continue to apply. Section 8(1) keeps the data fiduciary responsible for complying with the Act in respect of processing undertaken by it or on its behalf. Section 8(5) requires it to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent a personal data breach. Fully offshore-facing processing in the IFSC therefore still carries a statutory security obligation under Indian law.

Limits of the DPDP Act Exemption for GIFT IFSC

It does not exempt the entity. The exemption is activity-specific. An IFSC unit that also processes personal data of Indian data principals, for example its own employees in India, customers in India, or vendors, is a data fiduciary in respect of that processing and must comply in full.

It does not survive a change in the contractual counterparty. The processing must be pursuant to a contract with a person outside India. Where the same operation begins serving an Indian group entity or an Indian client, the second condition fails for that work.

It does not displace other obligations. Section 17(1) exempts the specified chapters and section, save for section 8(1) and (5), which continue to apply. Obligations outside them, and obligations under other laws, continue. In the IFSC context, three in particular remain: IFSCA’s AML, CFT and KYC guidelines with their record-keeping and reporting requirements (Article 35); IFSCA’s cyber security and cyber resilience guidelines, which require confidentiality, integrity and availability of IT assets, incident handling, audit trails and third-party risk management (Article 36); and contractual and foreign-law obligations owed to the offshore client, which are frequently more demanding than Indian law.

It does not answer the foreign-law question. Data relating to individuals in other jurisdictions may attract those jurisdictions’ laws. An Indian statutory exemption does not affect, for example, obligations owed under the law governing the client’s own processing.

When the Obligations Begin

The DPDP Act was enacted in 2023, but its operative provisions were sequenced through the Digital Personal Data Protection Rules, 2025, notified in November 2025. The commencement is phased:

The practical consequence for an IFSC entity is that the compliance deadline is not immediate but is fixed. As at 17 September 2026, the substantive obligations are not yet in force, and the intervening period is the window in which policies, systems and contracts are expected to be aligned. The dates above are computed from the Gazette publication of the Rules (G.S.R. 846(E), dated 13 November 2025), from which the one-year and eighteen-month periods run. Where a specific day is critical, the counting convention should be confirmed against the commencement provisions.

Building for the Exemption

1. Contract with a person outside India. The processing must be traceable to such a contract. Intra-group arrangements should be documented as contracts with the offshore entity, not assumed from the group relationship.
2. Data principals outside India. The operation should be able to show, by design, that the data sets processed under that contract relate to individuals outside India. Mixed data sets are the most common risk, and segregation is easier to build at the outset than to retrofit.
3. Segregate the exempt and non-exempt processing. Employee data, vendor data and any India-facing service line should be managed under a full DPDP compliance programme. Two regimes running in one entity is manageable; one undifferentiated regime is not.
4. Align with the security obligations that apply regardless. Section 8(5) of the Act itself continues to apply to exempt processing. The cyber security guidelines and AML record-keeping requirements already demand much of what a data protection programme requires, including access control, audit trails, incident response and third-party oversight. Building one control set that satisfies both is more efficient than parallel programmes.
5. Check the client’s own requirements. Offshore clients frequently impose their own data protection terms, and those obligations are enforceable as contract regardless of the statutory exemption.

Why this Matters for the IFSC’s Service Economy

The 2024 notification of book-keeping, accounting, taxation and financial crime compliance services as financial services, the Global In-house Centres framework and the TechFin and Ancillary Services Regulations have together made GIFT IFSC a location for processing work, not only for financial risk-taking. Section 17(1)(d) is the provision that makes that model workable under Indian data protection law, because it removes the notice-and-consent architecture from processing that has no Indian data subject.

But the exemption is drafted narrowly and by reference to facts that change over time: who the counterparty is, and where the individuals are. It should be treated as a condition to be maintained, not a status to be acquired.