Legitimate uses: processing without consent under section 7

A closed list of grounds

Unlike some other privacy laws, the DPDP Act has no open ended "legitimate interests" ground that you balance against the person's rights. Section 7 names specific situations. Anything outside them needs consent.

That makes the analysis simpler, but it also means you cannot stretch a legitimate use to cover marketing, profiling or product analytics because they seem reasonable.

The main legitimate uses

Section 7 has the exact wording. The uses include:

• Data a person voluntarily provides for a specified purpose, where they have not said they object to its use
• Providing a subsidy, benefit, service, certificate, licence or permit from the State, where the conditions in the Act and Rules are met
• The State or its instrumentalities performing a function under law, or acting in the interest of the sovereignty and integrity of India or the security of the State
• Complying with a legal obligation to disclose information to the State, or with a judgment or order
• Responding to a medical emergency involving a threat to life or immediate threat to health
• Providing medical treatment or health services during an epidemic or other threat to public health
• Ensuring safety or providing assistance during a disaster or breakdown of public order
• Employment purposes, or protecting the employer from loss or liability, such as preventing corporate espionage

Examples in Indian businesses

A customer messages a D2C brand on WhatsApp with her address and asks for a saree to be delivered. Using that address to ship the order fits data voluntarily provided for a specified purpose. Adding her number to a festive sale broadcast does not.

A hospital treating an unconscious accident patient can process his details without consent under the medical emergency use. Later marketing of a health check package to him would need consent.

An IT services company processes employee bank details for salary and attendance records for payroll under the employment use. Monitoring personal social media accounts would need far more careful thought.

Other duties still apply

A legitimate use removes the need for consent. Your other duties remain: security safeguards, accuracy, erasure when the purpose is served, breach intimation and handling the rights that apply. Record which ground you rely on for each purpose, so you can answer a Data Principal or the Board clearly.

Recording the ground in TrustOS

In TrustOS, each purpose in the inventory carries its processing ground, either consent or a named legitimate use, with the reasoning and who approved it. When someone proposes a new use of existing data, the purpose review shows whether the existing ground covers it. The choice of ground is a legal judgement made by your team, and TrustOS records it. It does not replace legal advice.