Legitimate Uses Under DPDP: When You Don't Need Consent

Who this is for: legal counsel, DPOs and HR and operations leaders deciding the lawful basis for each processing activity.

Most discussion of the DPDP Act focuses on consent. But consent is only one of two lawful grounds. Section 4 allows personal data to be processed either with consent or for certain legitimate uses, which Section 7 lists in full. Getting this choice right matters: asking for consent where a legitimate use applies creates a withdrawal right you cannot honour, while relying on a legitimate use that does not fit leaves the processing unlawful.

This explainer walks through each legitimate use and its limits. For the consent alternative, see Valid Consent Under DPDP.

The closed list

There is no general "legitimate interests" ground of the kind found in the GDPR. If a purpose does not fit one of these clauses, it needs consent.

Section 7(a): the one most businesses will use

Section 7(a) is the workhorse for commercial processing. It covers personal data an individual voluntarily provides for a specified purpose, as long as they have not said they do not consent to that use. The Act's illustrations involve a buyer sharing details with a pharmacy to receive a receipt, and an individual sharing contact details to receive a product.

Three conditions limit it:

• Voluntary. The individual must actually provide the data. Data you obtain from third parties, infer or scrape is not "voluntarily provided".
• Specified purpose. The use is limited to the purpose for which the data was provided. A delivery address cannot become marketing data.
• No objection. If the individual indicates they do not consent to the use, Section 7(a) is no longer available for it.

The practical consequence: Section 7(a) is only as strong as your communication of the purpose. A clear notice of why data is collected is what defines "the specified purpose".

Section 7(i): employment

Employers can process employee data for employment purposes without consent, including to safeguard themselves from loss or liability (for example, preventing corporate espionage and protecting trade secrets, intellectual property and confidential information) and to provide services or benefits an employee requests.

The limit is genuine employment need. Payroll, attendance, performance management and access control are covered. Selling employee data, using it for unrelated marketing, or deploying intrusive monitoring that goes beyond what employment requires is not, and needs separate justification or consent.

Medical, epidemic and disaster uses

Sections 7(f) to 7(h) let organisations act quickly when lives and safety are at stake. They are deliberately narrow: an emergency involving a threat to life or immediate threat to health, an epidemic or outbreak, a disaster or breakdown of public order. Routine healthcare relies on Section 7(a) instead (see our healthcare guide).

State functions

Sections 7(b) and 7(c) apply to the State and its instrumentalities. Rule 5 and the Second Schedule set standards for processing under Section 7(b), such as lawfulness, purpose limitation and security. Private businesses generally cannot rely on these clauses for their own purposes, even when working on government programmes, unless they act on behalf of the State as a processor.

How the basis affects other obligations

Choosing the basis, purpose by purpose

Assign a basis to each processing activity in your Record of Processing Activities:

1. Does a specific Section 7 clause clearly fit this purpose? If yes, record which one and why.
2. If not, does the purpose need consent, and can you obtain valid consent?
3. If neither, stop or redesign the processing.

Avoid "belt and braces" approaches that ask for consent while privately relying on a legitimate use. If a customer withdraws and you keep processing, you will have misled them.

Common mistakes

• Assuming a legitimate interests ground exists. It does not.
• Stretching 7(a) to new purposes. Voluntarily provided data is limited to the purpose it was provided for.
• Treating all HR data as employment use. Monitoring and analytics beyond genuine employment needs require justification.
• Using emergency clauses for routine work. They cover emergencies only.
• Asking for consent you cannot honour. Where a legal obligation requires processing, consent is the wrong basis.

How ConsentifyAI helps

ConsentifyAI's ROPA module records the lawful basis for every processing activity, including the specific Section 7 clause where a legitimate use applies. That basis then drives the rest of the platform: which purposes appear in consent flows, which rights apply to a request, and which retention rules govern the data.