Legitimate uses under DPDP Section 7: when you don't need consent

Under the DPDP Act, 2023 you may process personal data only with the person's consent or for one of the legitimate uses listed in Section 7 (Section 4(1)). Section 7 is a closed list of nine situations, such as data a person voluntarily gives you for a purpose, legal obligations, court orders, medical emergencies and employment. If your processing doesn't fit one of them, you need consent.

This guide goes through each legitimate use, the conditions attached to it, and the duties that apply even when you don't need consent.

Two lawful bases, not six

The GDPR has six lawful bases, including contract and legitimate interests. The DPDP Act has two (Section 4(1)):

1. consent that meets Section 6; or
2. certain legitimate uses, which Section 2(d) defines as the uses in Section 7.

There is no general "legitimate interests" test and no separate "contract" basis. For a full comparison, see DPDP Act vs GDPR: how consent differs.

The nine legitimate uses

Clause	Use	Who can rely on it
7(a)	Data the person voluntarily provided for a specified purpose, where she hasn't said she doesn't consent	Any Data Fiduciary
7(b)	Providing a prescribed subsidy, benefit, service, certificate, licence or permit	The State and its instrumentalities
7(c)	Performing a function under law, or for sovereignty, integrity or security of the State	The State and its instrumentalities
7(d)	Fulfilling a legal obligation to disclose information to the State	Any person under such an obligation
7(e)	Complying with a judgment, decree or order under Indian law, or a foreign judgment or order on contractual or civil claims	Any Data Fiduciary
7(f)	Responding to a medical emergency threatening the life or immediate health of the person or anyone else	Any Data Fiduciary
7(g)	Medical treatment or health services during an epidemic, outbreak or other threat to public health	Any Data Fiduciary
7(h)	Safety, assistance or services during a disaster or breakdown of public order	Any Data Fiduciary
7(i)	Employment, or safeguarding the employer from loss or liability	Employers

7(a): voluntarily provided data

This is the clause most businesses will rely on, and the one most likely to be stretched. Three conditions apply:

• the person voluntarily provided the data to you;
• you use it for the specified purpose she provided it for; and
• she has not indicated that she doesn't consent to that use.

The Act gives two illustrations. A shopper at a pharmacy gives her number and asks for a payment receipt by SMS: the pharmacy may use the number to send the receipt. A person messages a property broker asking for help finding a flat: the broker may use her details to send suitable listings, but once she says she no longer needs help, the broker must stop.

The limits that follow from the text:

• The purpose is hers, not yours. The receipt example covers sending the receipt, not adding the number to a marketing list. A new purpose needs consent.
• It ends when she says so. Once she indicates she doesn't consent, 7(a) no longer covers the processing.
• Her rights still apply. Sections 11(1) and 12(1) expressly include data processed under 7(a): she can ask what you hold, and ask for it to be corrected or erased.

The Act does not define "voluntarily". In our reading, data you required as a condition of a service, or collected without the person knowingly giving it (for example through tracking), is a weak fit for 7(a); rely on consent instead.

7(i): employment

An employer may process personal data "for the purposes of employment or those related to safeguarding the employer from loss or liability". The Act's examples are preventing corporate espionage, keeping trade secrets, intellectual property and classified information confidential, and providing a service or benefit the employee asks for.

This covers ordinary HR processing such as payroll, attendance and access control. Uses that go beyond employment, such as marketing to employees or sharing their data for unrelated purposes, are outside it in our reading and need consent.

7(d) and 7(e): legal obligations and court orders

You may process personal data to disclose information to the State when a law obliges you to, following that law's rules on disclosure (7(d)), and to comply with judgments, decrees and orders, including foreign judgments on contractual or civil claims (7(e)). Tax, labour and sector regulators' reporting duties are typical examples of 7(d).

7(f) to 7(h): emergencies

Three clauses cover urgent situations: a medical emergency threatening someone's life or immediate health (7(f)), treatment or health services during an epidemic or public-health threat (7(g)), and safety, help or services during a disaster (as defined in the Disaster Management Act, 2005) or a breakdown of public order (7(h)). They protect people in a crisis; they are not a basis for routine processing.

7(b) and 7(c): the State

Clauses 7(b) and 7(c) are for the State and its instrumentalities: issuing prescribed subsidies, benefits, services, certificates, licences and permits, and performing functions under law or for national security. Rule 5 of the DPDP Rules, 2025 requires 7(b) processing to follow the standards in the Second Schedule, from 13 May 2027. Private companies can't rely on these clauses for their own processing.

What still applies without consent

A legitimate use removes the need for consent. It doesn't remove your other duties:

Duty	Applies to legitimate uses?
Notice under Section 5	No. Section 5(1) applies to requests for consent under Section 6
Reasonable security safeguards (Section 8(5))	Yes
Reporting personal data breaches (Section 8(6))	Yes
Accuracy where data is used for decisions or disclosed (Section 8(3))	Yes
Erasure once the purpose is no longer served, unless a law requires retention (Section 8(7))	Yes
Grievance redressal (Section 13)	Yes
Access, correction and erasure rights (Sections 11, 12)	For 7(a), which those sections name expressly

Legitimate uses also matter after a withdrawal: when someone withdraws consent, you must stop processing unless processing without consent is required or authorised under the Act or another law (Section 6(6)). A Section 7 use can be that authorisation, for example keeping records a law requires you to disclose. See withdrawal of consent under the DPDP Act.

Checklist

1. List every processing activity and give each one a basis: consent, or a named clause of Section 7.
2. Write down why each Section 7 use applies, so you can show your reasoning later.
3. Keep 7(a) narrow: the person's own purpose, voluntarily provided, and only until she says stop.
4. Use consent for everything else, especially marketing, profiling and sharing for new purposes. See DPDP Act consent requirements.
5. Apply the Section 8 duties to all processing, whatever the basis.
6. Re-map GDPR records: activities you based on contract or legitimate interests need consent or a specific Section 7 use.
7. Note the timing: these provisions apply from 13 May 2027, with the rest of the Data Fiduciary duties. See the DPDP Rules 2025 timeline.

Frequently asked questions

Is there a legitimate interests basis under the DPDP Act?

No. Section 4(1) allows processing only with consent or for the legitimate uses listed in Section 7. Unlike the GDPR, there is no general balancing test.

Can we send marketing messages under a legitimate use?

Generally not. Section 7(a) covers the purpose for which a person voluntarily provided her data, such as sending a receipt she asked for. Marketing is a separate purpose and needs consent.

Do we need to give a notice for processing under Section 7?

Section 5(1) requires a notice with every request for consent under Section 6, so it does not apply to processing under a legitimate use. Your other duties, such as security, breach reporting and erasure, still apply.

Do we need employees' consent to process their data?

Not for employment purposes. Section 7(i) covers processing for employment and for safeguarding the employer from loss or liability. Uses beyond that, in our reading, need consent.

Can a person object to processing under Section 7(a)?

Yes. Section 7(a) applies only while she has not indicated that she does not consent. Once she does, you must stop relying on it, as in the Act's property-broker illustration.

Where Consentrio fits

Consentrio is a consent management platform for India's DPDP Act. For the processing that does rely on consent, it gives you a single catalogue of purposes and data categories, versioned notices, consent capture through web, mobile and server SDKs, a preference centre for withdrawal, and a tamper-evident record of every consent as proof under Section 6(10).