Glossary
What are legitimate uses under DPDP?
Legitimate uses are the situations in which the DPDP Act allows processing without consent. They are listed in section 7.
Definition
Legitimate uses are the grounds in s.7 of the DPDP Act, 2023 on which a Data Fiduciary may process personal data without consent. Under s.4, processing is lawful only with consent (s.6) or for a legitimate use (s.7). There is no general legitimate interest ground.
What it means
Section 7 lists nine situations. If your processing fits one, you do not need consent for it, but duties such as reasonable security safeguards (s.8(5)) still apply. See legitimate uses under section 7.
Where it appears in the Act and Rules
| Clause | Legitimate use |
|---|---|
| s.7(a) | Data the Data Principal voluntarily provided for a specified purpose, without indicating she does not consent |
| s.7(b) | State subsidies, benefits, services, certificates, licences or permits (see also Rule 5) |
| s.7(c) | State functions, sovereignty and security |
| s.7(d) | A legal obligation to disclose information to the State |
| s.7(e) | Compliance with a judgment or order |
| s.7(f) | A medical emergency threatening life or health |
| s.7(g) | An epidemic or threat to public health |
| s.7(h) | A disaster or breakdown of public order |
| s.7(i) | Employment purposes, or safeguarding the employer from loss or liability |
Common misconceptions
- “Legitimate uses work like a legitimate interest test.” DPDP has no legitimate interest ground. Only the listed uses count.
- “Deemed consent is the right term.” The 2022 draft's deemed consent was replaced by legitimate uses in the 2023 Act.
- “Employment covers any use of employee data.” s.7(i) is for employment purposes or safeguarding the employer from loss or liability; check the scope with counsel (employee data guide).
Related terms
Free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6).
Deemed consentA 2022 draft Bill idea, replaced by legitimate uses in the Act (s.7).
Purpose limitationUsing personal data only for the specified purpose (s.4, s.6, s.8(7)).
Data FiduciaryDecides the purpose and means of processing personal data (s.2).
In TruePrivacy
Records of processing list your processing activities, synced from discovery and exportable, which gives you and counsel one place to review the ground for each. Processing that relies on consent runs through consent management.
Does DPDP have a legitimate interest ground?
No. Under s.4, processing is lawful only with consent or for one of the legitimate uses listed in s.7.
Is processing employee data a legitimate use?
Processing for employment purposes, or to safeguard the employer from loss or liability, is a legitimate use under s.7(i). Uses outside that scope may need consent.
What does s.7(a) cover?
Personal data a Data Principal voluntarily provided for a specified purpose, where she has not indicated that she does not consent to its use.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin