Section 7
Legitimate uses under the DPDP Act
Section 7 lists the situations in which a Data Fiduciary may process personal data without consent. The list is specific, and each use has its own limits.
Short answer
Under s.4 of the DPDP Act, personal data may be processed only with consent (s.6) or for a legitimate use listed in s.7. Section 7 sets out nine legitimate uses, from data a person voluntarily provides for a specified purpose to employment purposes. There is no “legitimate interest” ground, and “deemed consent” appeared only in the 2022 draft Bill.
The nine legitimate uses in s.7
| Clause | Legitimate use |
|---|---|
| s.7(a) | Data the Data Principal voluntarily provided for a specified purpose, where she has not indicated that she does not consent to its use |
| s.7(b) | The State providing a subsidy, benefit, service, certificate, licence or permit (see Rule 5) |
| s.7(c) | The State performing a function under law, or in the interest of the sovereignty and integrity of India or the security of the State |
| s.7(d) | Fulfilling a legal obligation to disclose information to the State |
| s.7(e) | Complying with a judgment or order |
| s.7(f) | A medical emergency involving a threat to life or health |
| s.7(g) | An epidemic or other threat to public health |
| s.7(h) | A disaster or a breakdown of public order |
| s.7(i) | Employment purposes, or safeguarding the employer from loss or liability |
Rule 5 adds detail for processing by the State for a subsidy, benefit, service, certificate, licence or permit. For a short definition, see the legitimate uses glossary entry.
No legitimate interest, no deemed consent
The Act has no general “legitimate interest” ground. If a purpose does not fit one of the nine uses, you need consent (s.4).
“Deemed consent” is not a concept in the enacted Act. The 2022 draft Bill had a deemed consent clause; the 2023 Act replaced it with “certain legitimate uses” in s.7. See deemed consent.
Reading s.7(a) and s.7(i) carefully
Section 7(a) covers data a person voluntarily gives you for a specified purpose, where they have not said they do not consent. It is tied to that specified purpose, so it does not stretch to other uses of the same data. If the person tells you she does not consent to the use, s.7(a) no longer covers it.
A customer emails Example Finance a payslip to get a loan quote. Preparing that quote is the specified purpose. Using the payslip for marketing is a different purpose and needs its own ground.
Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. HR teams should still map which employee data each purpose needs; see employee data under DPDP.
The general duties still apply
A legitimate use replaces consent as the lawful ground. The general duties of a Data Fiduciary in s.8 still apply, including:
- reasonable security safeguards (s.8(5), Rule 6);
- breach intimation (s.8(6), Rule 7);
- completeness and accuracy when data is used for a decision or disclosed (s.8(3));
- erasure once the purpose is no longer served, unless a law requires retention (s.8(7));
- using Data Processors only under a valid contract (s.8(2)); and
- effective grievance redressal (s.8(10)).
Document each reliance
- 01Name the purpose
Write the purpose in one plain sentence, as you would in a notice.
- 02Match it to a clause
Record the s.7 clause you rely on and why the purpose fits it. If none fits, use consent.
- 03List the data and systems
Record the personal data used and where it is held, so the reliance can be checked later.
- 04Set retention
Decide when the purpose is no longer served and what happens to the data then (s.8(7)).
- 05Review with counsel
Have counsel check each reliance on s.7, and check again when the purpose changes.
Relying on s.7 for a purpose it does not cover leaves the processing without a lawful ground under s.4. If you are unsure which ground applies, check with counsel.
How TruePrivacy helps
Records of processing in TruePrivacy hold each processing activity, synced from discovery and exportable, giving you one place to document purposes. Retention rules act on data once its keep-for period ends, optionally with approval, and log each execution.
Where a purpose does need consent, consent management keeps a record per person and purpose. See also how TruePrivacy approaches purpose limitation.
Can personal data be processed without consent in India?
Yes, but only for one of the nine legitimate uses in s.7. Otherwise consent under s.6 is needed (s.4).
Does the DPDP Act have a legitimate interest basis?
No. The Act lists specific legitimate uses in s.7 and has no general legitimate interest ground.
What happened to deemed consent?
It appeared in the 2022 draft Bill. The 2023 Act replaced it with certain legitimate uses in s.7.
Can employers process employee data without consent?
Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. Map each purpose to it and check edge cases with counsel.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin