Navigating Surveillance Carve-outs: DPDPA Section 17(2) vs. EU Adequacy Standards

The landscape of data protection globally is increasingly defined by the tension between individual privacy rights and governmental access to personal data. For Indian businesses operating in an interconnected world, understanding how India’s Digital Personal Data Protection Act, 2023 (DPDPA) addresses government surveillance, particularly through Section 17(2), and how this compares with the stringent standards set by the European Union, notably post-Schrems II, is critical. As of October 2026, these comparative frameworks shape not only domestic compliance but also the viability of cross-border data flows.

India’s Framework: DPDPA Section 17(2) and Allied Provisions

The DPDPA, while establishing a robust framework for personal data protection, incorporates specific provisions for state access to data. Central to this is Section 17(2), which grants a broad exemption to “any instrumentality of the State” from several key provisions of the Act. Specifically, it allows such entities to process personal data without adhering to obligations related to data fiduciary duties (Chapter II), data principal rights (Chapter III), and even cross-border data transfer restrictions (Chapter IV), among others. This exemption is applicable when processing is deemed necessary for “specified purposes,” including national security, public order, prevention, investigation, or prosecution of any offence.

Crucially, the DPDPA itself does not explicitly detail the procedural safeguards, oversight mechanisms, or proportionality tests that must be met by the State instrumentality when invoking Section 17(2). While existing laws like the Information Technology Act, 2000 (IT Act), particularly Section 69, and its associated IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, govern interception and access to electronic information, the DPDPA does not directly integrate these safeguards or mandate additional judicial review within its own framework for these exemptions. Furthermore, regulations from bodies like the Reserve Bank of India (RBI) on data localisation for payment system operators, while not surveillance-specific, ensure that certain critical data remains within India’s jurisdiction, thereby subjecting it to Indian legal requests for access.

The EU Standard: GDPR Article 23 and the Schrems II Mandate

In contrast, the European Union’s General Data Protection Regulation (GDPR) also includes provisions for state access to data. Article 23 allows Member States to restrict the scope of data protection rights and obligations when such restriction respects the “essence” of fundamental rights and freedoms and is a “necessary and proportionate measure” to safeguard objectives such as national security, defence, or public security.

However, the interpretation and application of these principles were profoundly shaped by the Court of Justice of the European Union’s (CJEU) landmark Schrems II judgment (Case C-311/18). This ruling invalidated the EU-US Privacy Shield, primarily due to concerns over US government surveillance laws (like FISA Section 702) lacking sufficient safeguards for EU data subjects. The CJEU emphasized that for data transfers to a third country to be permissible, the recipient country’s legal framework, including its government access powers, must offer “essential equivalence” to EU standards. This implies:

1. Necessity and Proportionality: Any state access to data must be strictly necessary and proportionate to the legitimate objective pursued, as interpreted under Articles 7, 8, and 47 of the Charter of Fundamental Rights of the EU.
2. Effective Judicial Remedies: Data subjects must have access to effective judicial remedies and independent oversight mechanisms to challenge state access to their data. The judgment found US mechanisms insufficient in this regard.

These Schrems II principles now form the bedrock against which any third country’s legal framework is assessed for an EU adequacy decision, making government surveillance laws a primary point of scrutiny.

Comparative Analysis: Stricter, Looser, or Silent

Comparing these two regimes reveals distinct approaches and potential friction points:

• Scope of Exemption: DPDPA Section 17(2) provides a broad exemption, relieving instrumentalities of the State from numerous DPDPA obligations. This approach is arguably looser than the GDPR’s Article 23, which requires any restriction to respect the “essence” of fundamental rights and be necessary and proportionate. The DPDPA’s text does not explicitly embed these proportionality tests or the “essence” requirement within the exemption itself.
• Oversight and Redress: This is perhaps the most significant divergence. The Schrems II judgment demands robust, independent judicial oversight and effective remedies for data subjects whose data is accessed by the state. The DPDPA, in Section 17(2), is silent on these specific mechanisms, relying on existing legal frameworks and executive discretion. This silence, from an EU perspective, would likely be deemed insufficient to meet the “essential equivalence” standard for judicial redress.
• Conditions for Invocation: While DPDPA 17(2) lists legitimate grounds like national security, the process for invoking these exemptions and the internal checks and balances are not delineated within the Act. The EU standard, post-Schrems II, requires a demonstration of strict necessity and proportionality, subject to judicial review, which is a more stringent requirement for government access.
• Data Localisation: India’s RBI regulations on data localisation (e.g., for payment data) can be seen as stricter from a data exporter’s perspective, as they mandate data residency. However, this also means the data is definitively subject to India’s surveillance laws, which, when viewed through the Schrems II lens, might not offer the same level of protection as EU law due to the broader carve-outs and less explicit judicial oversight.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, understanding these differences is paramount, especially when engaging in cross-border data transfers, particularly with the EU. The broad nature of DPDPA Section 17(2) and the lack of explicit judicial oversight mechanisms within the Act itself present a significant hurdle for India to potentially achieve an EU adequacy decision. Businesses transferring data from the EU to India must conduct thorough Transfer Impact Assessments (TIAs) to evaluate the risks posed by Indian government access laws against Schrems II standards. This may necessitate implementing robust supplementary measures, such as strong contractual clauses, encryption, and anonymisation techniques, to mitigate risks and ensure data protection. Conversely, Indian companies handling EU data must be prepared for increased scrutiny of their data processing environments in India, acknowledging that the DPDPA’s approach to state access differs considerably from the EU’s post-Schrems II mandate.