Rule 16 — Exemption From the Act for Research, Archiving or Statistical Purposes

Rule 16 states the exemption in one sentence: the provisions of the Act don't apply to processing personal data that's necessary for research, archiving or statistical purposes, if that processing is carried on in accordance with the standards specified in the Second Schedule. The operative word is "necessary," and the operative test is the Second Schedule — the exemption isn't triggered by the purpose being labelled research, it's triggered by the processing actually satisfying eight specific conditions.

What the Second Schedule actually requires

The Second Schedule sets out standards for processing under Section 7(b) of the Act and under Section 17(2)(b) — and Rule 16 borrows the same standards for the research/archiving/statistical exemption. Read together, they require: processing carried out lawfully; done for the specific use or purpose in question; limited to the personal data actually necessary for that use or purpose; carried out while making reasonable efforts to keep the data complete, accurate and consistent; retained only as long as needed for that use or purpose, or as required by law; protected by reasonable security safeguards against a breach, covering any processing a Data Processor does on the Fiduciary's behalf too; accompanied, where the processing falls under Section 7(b), by an intimation to the Data Principal that includes a business contact point, a link to the relevant website or app, and a description of any other means to exercise her rights; and, throughout, accountability resting with whoever alone or jointly determines the purpose and means of the processing.

In effect, "necessary for research" is not a self-certifying label — it's a standard the processing has to be built to satisfy on an ongoing basis, not a purpose declared once at the outset and left unchecked.

What doesn't qualify by default

Product analytics and AI model training are the two purposes most often mislabelled as "research" to reach for this exemption, and neither qualifies automatically. Product analytics that shapes a commercial feature, or a training dataset that feeds a production model, is processing done for a business purpose — it can only fall under Rule 16 if it's genuinely necessary for research, archiving or statistical purposes specifically, and the Second Schedule's conditions are actually being met, not merely invoked as a label after the fact.

Why this matters in practice

The recurring failure pattern is purpose drift without a corresponding tightening of controls: data gets collected under a genuine research purpose, satisfies the Second Schedule's conditions at the outset, and is later reused for a product feature or folded into a model-training pipeline once the research project winds down. The purpose expands, but the retention, minimisation and security controls that justified the original exemption don't expand with it — which means the exemption stops applying at the moment the purpose shifts, even if no one updates the internal documentation to reflect that.

Illustration: a healthtech company runs a genuine clinical research study using de-identified but still personal patient data, with retention limits and access controls calibrated to the study's Second Schedule obligations. Once the study concludes, a product team wants to reuse the same dataset to train a symptom-checker feature bound for general release. That reuse is not "research" — it's product development — and it needs its own lawful basis under the Act rather than continuing to shelter under Rule 16's exemption, because the purpose, and the controls that should track it, have changed.

How Rule 16 connects to the rest of the Rules and the Act

Rule 16 shares its standards with Rule 5(1), which applies the same Second Schedule to processing by the State and its instrumentalities under Section 7(b) of the Act and Section 17(2)(b) — so understanding one helps with the other, though the two exemptions serve different purposes (State functions in one case, research/archiving/statistics in the other). A Data Fiduciary claiming Rule 16 should be able to show, purpose by purpose, that the Second Schedule's conditions are being met in practice — not just recite the exemption's existence if the Board ever asks.