Legitimate uses: when you can process personal data without consent

The DPDP Act is often described as a consent law. It isn’t only that. Section 7 lists “certain legitimate uses” where a Data Fiduciary may process personal data without consent. Knowing them stops you from asking for consent you don’t need, and from relying on a ground you can’t.

Unlike the GDPR, there’s no open-ended “legitimate interests” ground. If your purpose isn’t on this list, you need consent.

The nine legitimate uses

1. Data given voluntarily for a specified purpose (s.7(a)) When someone voluntarily gives you data for a specific purpose and doesn’t say they object to its use. The Act’s example: a buyer shares their phone number with a pharmacy to receive a payment receipt. The pharmacy can use it for that receipt. It can’t use it for marketing.

2. State subsidies, benefits, services, licences and permits (s.7(b)) For the State and its instrumentalities, where the person has previously consented or the data is in a government database. Rule 5 and the Second Schedule set standards for this.

3. State functions under law (s.7(c)) The State performing a function under any law, or in the interest of sovereignty, integrity or security of India.

4. Legal obligations to disclose to the State (s.7(d)) Where a law requires anyone to disclose information to the State or its agencies.

5. Court judgments and orders (s.7(e)) Complying with a judgment, decree or order under Indian law, or a foreign judgment on contractual or civil claims.

6. Medical emergencies (s.7(f)) Responding to a medical emergency involving a threat to life or immediate health of the person or anyone else.

7. Epidemics and public health threats (s.7(g)) Providing medical treatment or health services during an epidemic, outbreak or other threat to public health.

8. Disasters and breakdown of public order (s.7(h)) Ensuring safety of, or providing assistance to, people during a disaster or breakdown of public order.

9. Employment (s.7(i)) For employment purposes, or to safeguard the employer from loss or liability, such as preventing corporate espionage, protecting confidential information and trade secrets, or providing a service or benefit an employee asks for.

Duties still apply

A legitimate use removes the need for consent. It doesn’t remove other duties. You still need reasonable security, breach reporting, accuracy, erasure when the purpose ends, and a grievance process.

Common mistakes

• Treating “voluntarily provided” as a blank cheque. It covers the specific purpose the person gave the data for, nothing more.
• Stretching “employment purposes” to cover everything about employees, including family members’ data or social-media monitoring. Be conservative.
• Asking for consent when a legitimate use applies. If you ask, people may refuse or withdraw, and you’ve created an expectation you may not be able to honour.

Go deeper

Our courses map common business processes to the right ground. Browse the courses.

This article is for education and is not legal advice.