... EXCLUDE ?:* INCLUDE C:\data\...\*
TSM still backups all data on all drives. though according to Backup-Archive Clients Installation and User's Guide ?:* expands to ?:\...\* which means all files on all drives should be excluded. at the same time all files and directories inside C:\data should be included in backup.
one guy on adsm.org points out it's necessary to use either EXCLUDE.DIR directive to explicitly exclude all unnecessary directories or DOMAIN directive to explicitly include necessary directories only (they are to be shared in this case).
the 1st method is somewhat cumbersome and requires additional efforts to track changes to filesystem and update include-exclude list accordingly. the 2nd method looks better and it would be great should VIRTUALMount option exist for Windows. but alas - it's available for Linux and UNIX only. so it's necessary to share required directories by means of operating system.
in my case I shared directories with the following commands:
> net share deploy=C:\deploy > net share signature=C:\signature
afterwards I granted read permission to these directories for myself (ecls\tap) only and set TSM Client Scheduler service to log on as me (ecls\tap) as well. at the same time I left TSM Client Acceptor service to log on under Local System account - it really doesn't matter who it logs on as since it's TSM Client Scheduler service that actually performs backup.
finally I modified my dsm.opt file this way to backup aforementioned directories only:
NODENAME opr7 TCPSERVERADDRESS oprgate PASSWORDACCESS GENERATE MANAGEDSERVICES WEBCLIENT SCHEDULE DOMAIN -SYSTEMSTATE DOMAIN \\opr7\deploy DOMAIN \\opr7\signature
and it's necessary to restart TSM Client Acceptor service in the end for changes to take effect.