DPDP Glossary
Legitimate Use
Certain legitimate uses listed in Section 7 for which personal data may be processed without consent under Section 4.
Sections 4 and 7
What it means
Section 4 allows processing for a lawful purpose with consent or for certain legitimate uses. Section 7 lists those legitimate uses — specific statutory situations, not an open-ended “legitimate interest” clone from other regimes. If your facts are not in Section 7, you do not create a new legitimate use by policy drafting.
Worked example
A Fiduciary that processes data because “it helps our business model” without fitting a Section 7 entry, and without Section 6 consent, is not on a legitimate-use basis merely by using those words in a privacy policy.
In practice
For each processing activity, decide: consent, a listed Section 7 use, or stop. Document the Section 7 mapping with counsel. Do not retrofit consent artefacts onto processing that never relied on consent — and do not skip consent where consent is the real basis.
Source
Sections 4 and 7 · Official text (PDF)
Educational summary based on the Digital Personal Data Protection Act, 2023 and Rules, 2025. Not legal advice.