Rule 16 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 16 says that the Act does not apply to processing of personal data necessary for research, archiving or statistical purposes if it is carried on in accordance with the Second Schedule standards. The same Schedule also supplies the standards that rule 5 requires for State processing for subsidies, benefits, services, certificates, licences and permits.
Rule 16 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. The exemption has one condition: the processing must be necessary for research, archiving or statistical purposes and carried on in accordance with the standards in the Second Schedule. Those standards, items (a) to (h), require lawful, limited, accurate, secured and accountable processing. Item (g) applies only to State processing under section 7(b).
Rule 16 in full
"The provisions of the Act shall not apply to the processing of personal data necessary for research, archiving or statistical purposes if it is carried on in accordance with the standards specified in Second Schedule."
The rule works with clause (b) of sub-section (2) of section 17 of the Act, which lets the Central Government exempt that kind of processing when personal data is not used to take any decision specific to a Data Principal and it is carried on in accordance with standards prescribed. The Act's wording is in Section 17(2) of the DPDP Act: State security, research and statistics; this article stays with the Rule. If your project is research-led and you are unsure whether it qualifies, a legal consultation can test the facts against the standards below.
Three points from the words of the rule:
- The exemption covers "the provisions of the Act" as a whole, not one section.
- It applies to processing "necessary for" research, archiving or statistical purposes. The Rules do not define those three purposes.
- It applies "if" the processing is carried on in accordance with the Second Schedule. If the standards are not met, the rule's condition is not met.
Commencement: rule 1(4) puts rule 16 among rules 3, 5 to 16, 22 and 23, which come into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. The Second Schedule has no commencement line of its own and follows rules 5 and 16. See rules 1 and 2.
The Second Schedule: two uses, one list
The Schedule's heading is "". It sets "Standards for processing of personal data by State and its instrumentalities under clause (b) of section 7 and for processing of personal data necessary for the purposes specified in clause (b) of sub-section (2) of section 17". So it serves two readers: the State processing for a benefit under rule 5, and the researcher, archivist or statistician under rule 16.
It begins: "Implementation of appropriate technical and organisational measures to ensure effective observance of the following, in accordance with applicable law, for the processing of personal data, namely". Then items (a) to (h).
| Item | Standard |
|---|---|
| (a) | Processing is carried out in a lawful manner |
| (b) | Processing is done for the uses specified in clause (b) of section 7, or the purposes specified in clause (b) of section 17(2), as the case may be |
| (c) | Processing is limited to personal data necessary for those uses or purposes |
| (d) | Reasonable efforts to ensure completeness, accuracy and consistency of personal data |
| (e) | Personal data retained till required for those uses or purposes, or for compliance with any law for the time being in force |
| (f) | Reasonable security safeguards to prevent personal data breach, including for a Data Processor acting on its behalf |
| (g) | Where processing is under clause (b) of section 7: intimation to the Data Principal with (i) business contact information, (ii) the communication link and other means to exercise rights, and (iii) consistency with other applicable standards |
| (h) | Accountability of the person who alone or with others determines the purpose and means of processing |
Items (a) to (c): lawful, on purpose, and limited
Item (a) requires lawful processing. Item (b) ties the processing to the purpose that justifies it: for a researcher that is the clause (b) purpose of section 17(2), for the State it is the section 7(b) use. Item (c) is a data minimisation standard: "limited to such personal data as is necessary for such uses or achieving such purposes".
A university team studying commuting patterns therefore cannot also collect, say, family medical histories "just in case"; those would not be necessary for the study. (The example is invented.)
Items (d) and (e): accuracy and retention
Item (d) asks for "reasonable efforts to ensure the completeness, accuracy and consistency" of the data. It is an effort standard, not a promise of a perfect result. Item (e) allows retention "till required for such uses or achieving such purposes, as the case may be, or for compliance with any law for the time being in force". There is no fixed period; the test is need. Compare the fixed periods in rule 8 and the Third Schedule, which are a different regime.
Item (f): security safeguards
Item (f) asks for "reasonable security safeguards to prevent personal data breach to protect personal data in the possession or under control of the Data Fiduciary, including in respect of any processing undertaken by it or on its behalf by a Data Processor". The wording echoes rule 6, which is explained in our article on reasonable security safeguards. The Schedule does not say that the detailed list in rule 6(1) applies; it prints only this sentence.
Item (g): intimation, for State benefits only
Item (g) opens "Where processing is to be done under clause (b) of section 7 of the Act". It is therefore a standard for State processing for benefits, not for a researcher under rule 16. The Data Principal must be given an intimation and, with it, (i) the business contact information of a person who can answer questions on behalf of the Data Fiduciary, and (ii) the particular communication link for the website or app and a description of other means, if any, to exercise rights under the Act.
Drafting note: sub-item (iii), "is carried on in a manner consistent with such other standards as may be applicable to the processing of such personal data under policy issued by the Central Government or any law for the time being in force", does not follow from the opening words of item (g), which speak of "giving the Data Principal an intimation". It reads as a separate standard for the processing. It is quoted as printed.
Item (h): accountability
"Accountability of the person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, for effective observance of these standards." That is the Act's description of a Data Fiduciary, applied to the standards. Whoever decides the purpose and means answers for the standards, including where several parties decide jointly.
Which items bite on a researcher?
Rule 16 asks for processing "in accordance with the standards specified in Second Schedule". The Schedule does not split the items into those for the State and those for researchers, except by the opening words of item (g). Items (a) to (f) and (h) are written for both; item (g) is tied to section 7(b). That reading comes from the text, and the Rules contain no Illustration for rule 16.
Need help with a research or statistics project?
Whether a project is research, archiving or statistics, and whether the Second Schedule standards are in place, are questions of fact and documents. Speak to our legal team to map your data flows against items (a) to (h).
Key takeaways
- Rule 16 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- The Act does not apply to processing necessary for research, archiving or statistical purposes carried on in accordance with the Second Schedule.
- The Second Schedule has eight standards, (a) to (h), shared with State processing under rule 5.
- Item (g) applies only where processing is under clause (b) of section 7.
- The three purposes are not defined in the Rules.
- Later amendments and notifications should be checked.
Read next
- Rule 5: processing by the State for subsidy, benefit, service, certificate, licence or permit
- Rule 6: reasonable security safeguards
- Section 17(2) of the DPDP Act: State security, research and statistics
- Rules 1 and 2: staged commencement
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.