Glossary
What is deemed consent under DPDP?
Deemed consent appeared in the 2022 draft Bill. It is not part of the enacted DPDP Act, 2023.
Definition
Deemed consent is not a concept in the enacted DPDP Act, 2023. The 2022 draft Bill had a “deemed consent” clause; the 2023 Act replaced it with “certain legitimate uses” in s.7. Under s.4, processing without consent is lawful only for a legitimate use listed in s.7.
What it means
Older articles still use the phrase deemed consent. Under the enacted Act, the question to ask is whether your processing fits one of the legitimate uses in s.7.
If it does not, you need consent that meets s.6, given against a notice under s.5. See consent under section 6.
Where it appears in the Act and Rules
| Source | What it says |
|---|---|
| 2022 draft Bill | Had a deemed consent clause |
| s.4 | Process only with consent or for a legitimate use |
| s.6 | The consent standard |
| s.7 | Certain legitimate uses, listed in clauses (a) to (i), which replaced deemed consent |
Common misconceptions
- “Deemed consent is a DPDP ground.” It is not. Without consent under s.6, you need a legitimate use under s.7.
- “Legitimate uses are deemed consent renamed.” They are a specific list in s.7, each with its own conditions. Read them with counsel.
- “A legitimate interest test applies.” DPDP has no legitimate interest ground; s.4 allows consent or legitimate uses only.
Related terms
The listed grounds for processing without consent (s.7).
ConsentFree, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6).
NoticeThe information that comes with every request for consent (s.5, Rule 3).
Purpose limitationUsing personal data only for the specified purpose (s.4, s.6, s.8(7)).
In TruePrivacy
Where you rely on consent, consent management keeps a consent record per person and purpose with an event log. Records of processing list your processing activities in one exportable place, so you and counsel can review the ground for each.
Is deemed consent part of the DPDP Act?
No. The 2022 draft Bill had a deemed consent clause, but the enacted 2023 Act replaced it with certain legitimate uses in s.7.
What replaced deemed consent?
Section 7, “certain legitimate uses”. Examples include data a Data Principal voluntarily provided for a specified purpose without saying she does not consent, a medical emergency, and employment purposes.
Can I rely on deemed consent for employee data?
No. Look at s.7(i), which covers processing for employment purposes or to safeguard the employer from loss or liability, and check its scope with counsel.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin