Legitimate uses under DPDP Section 7: processing without consent
Updated 26 Sep 2026 · 5min read · Reviewed by ConsentLo's DPDP audit team
Consent is the main ground for processing under the DPDP Act, but not the only one. Section 7 lists "certain legitimate uses" where no consent is needed. The list is closed, so it pays to know exactly what it covers.
The legitimate uses
A Data Fiduciary may process personal data without consent:
- For the specified purpose for which a person voluntarily provided their data, where they have not said they do not consent to its use.
- For the State to provide subsidies, benefits, services, certificates, licences or permits.
- For the State to perform functions under law or in the interest of sovereignty, integrity or security of India.
- To fulfil a legal obligation to disclose information to the State.
- To comply with a judgment, decree or order.
- To respond to a medical emergency involving a threat to life or health.
- To provide medical treatment or health services during an epidemic or threat to public health.
- To ensure safety or provide assistance during a disaster or breakdown of public order.
- For employment purposes, or to safeguard the employer from loss or liability, such as preventing corporate espionage.
Voluntary sharing in practice
The first use is the one businesses rely on most. If a customer shares their phone number so you can deliver an order, you may use it for delivery. It does not stretch to marketing or other purposes the person did not have in mind.
Employee data
Employment purposes cover everyday HR processing, such as payroll, attendance and security. Keep it proportionate, and use consent for anything beyond employment, such as marketing or optional programmes.
Record your basis
Other obligations, such as security safeguards, accuracy, retention limits and breach reporting, still apply to processing under a legitimate use. For each activity, record the basis you rely on and why. ConsentLo's data map will not let an activity go live without a documented basis.
Frequently asked questions
Does DPDP have a legitimate interest basis?
No. Section 7 is a closed list of specific legitimate uses; there is no general legitimate-interest ground as under the GDPR.
Do employers need consent to process employee data?
Not for employment purposes, which is a legitimate use. Consent is still needed for processing beyond employment.
Do DPDP obligations apply when processing without consent?
Yes. Security safeguards, retention limits, accuracy and breach reporting apply whatever the basis.