Here is the sentence that has launched a hundred editorials about India's data protection law: the government can, by notification, exempt its own instrumentalities from the Act — the same Act written to discipline how everyone handles your data. Critics call it the law's original sin. The government calls it the price of governing a nation of security threats and welfare programmes at continental scale. Both sides are arguing about something real — and this episode presents both at full strength, without caricature.

First, what the provisions actually say: Section 17's two levels, the notification power and its grounds — sovereignty, security, friendly relations, public order — plus the government's power to demand information from any fiduciary, the platform-blocking power on repeat penalisation, and the state's different retention posture. Then the criticism, stated properly: elastic grounds, executive notification without per-use parliamentary process, no sunset or independent review, the conflict of a state that is both the largest data collector and the author of its own exemptions — and Justice Srikrishna's own public objections to the widening. Then the defence, equally properly: every data protection law on earth carves out national security; a welfare state at India's scale cannot let benefit delivery die at a consent screen; and notification-by-notification exemption at least creates a paper trail.

Then the piece to carry away: the Puttaswamy shadow. A statutory exemption removes the Act's obligations — it cannot remove the fundamental right, and every notification remains testable against legality, legitimate aim, proportionality and safeguards. Plus the instrumentality seam where future litigation will run, the four-question checklist for every government-adjacent contract, what citizens should honestly expect, and why the best answer to the wide-lane criticism would be a state that rarely needs to drive in it.

DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon.

I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality.

Keywords: Section 17 DPDP, state exemptions, government data exemption, instrumentality of state, Puttaswamy proportionality, surveillance concerns, DPDP criticism, data protection government, blocking power, DPDP Act debate.

Connect with me:
💼 LinkedIn: https://www.linkedin.com/in/hskapoor/
📄 Facebook: https://www.facebook.com/satarkintelligence
▶️ YouTube: https://www.youtube.com/@DPDPdaily
🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111
𝕏 X: https://x.com/TheOtherKapoor

One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon.

This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.