When DPDP doesn't need consent: legitimate uses (s.7)

At a glance

Consent is the main route to process personal data under India’s DPDP Act — but Section 7 sets out a closed list of nine “legitimate uses” where you don’t need it, including data a person voluntarily gives for a purpose, certain employment purposes, and medical emergencies. It’s a defined, limited list — not a catch-all. Anything outside it still needs consent.

Educational resource only. This explains the legitimate-use provision of India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

What is a “legitimate use” under DPDP?

A legitimate use is a specific, lawful ground to process personal data without consent — and it’s a closed list, not a general exception. It names exactly nine. If your situation fits one of them, you don’t need a consent box for that processing; if it doesn’t, consent is back to being the rule. Note that this replaced the older idea of “deemed consent” — that term was dropped in the 2023 Act and rewritten as these defined legitimate uses, which is a common point of confusion.

What are the nine legitimate uses?

Processing without consent is permitted only in these nine cases:

1. Data the person has voluntarily provided for a purpose and hasn’t indicated they object to.
2. The State providing a subsidy, benefit, service, certificate, licence, or permit.
3. Performance of a function of the State under law, or in the interest of sovereignty and security.
4. Fulfilling a legal obligation to disclose information to the State.
5. Compliance with a judgment, decree, or order.
6. Responding to a medical emergency.
7. Public-health measures — an epidemic, outbreak, or threat to public health.
8. Ensuring safety during a disaster or breakdown of public order.
9. Employment purposes.

The two that matter most for a typical business

For most private businesses, only two of the nine come up — voluntary provision and employment.

• Voluntary provision (Section 7(a)). If a person hands you their data for a clear purpose — a customer gives their number to get a delivery update — and hasn’t said they object, you can use it for that purpose without a separate consent box. The catch: it covers only the purpose they handed it over for. Stretch it to marketing or cross-sell and you’re back to needing consent.
• Employment (Section 7(i)). You can process employee data for employment-related purposes — recruitment, payroll, attendance — and to protect yourself from loss or liability (corporate espionage, trade secrets, confidential information). This is the load-bearing caveat for HR: you don’t need a consent box to run payroll, but the use has to stay within that employment purpose.

Where legitimate use stops

Legitimate use is tied to the original purpose — it is not an open licence. The most common error is treating “they gave it voluntarily” or “they’re my employee” as permission for anything. Two hard limits:

• A new purpose needs fresh consent. Data collected under a legitimate use can’t quietly drift into marketing, profiling, or sharing with partners.
• Children’s data is excluded. Processing the data of anyone under 18 needs verifiable parental consent regardless — the legitimate-use route doesn’t cover it.

Does legitimate use remove your other duties?

No — it only removes the consent requirement, not everything else. Even when you’re relying on a legitimate use, you still owe the rest of your obligations: keep the data secure, use it only for that purpose, hold it no longer than needed, and honour people’s rights over it. Legitimate use answers one question — “do I need consent for this?” — and nothing more.

FAQ