Legitimate Interest
A lawful ground under GDPR that lets organisations process data for their own legitimate purposes. The DPDP Act has no such ground.
"Legitimate interest" is a flexible legal ground in European law that lets a business process data for its own genuine business purposes after weighing the impact on the individual. The DPDP Act does not have it. In India you need consent or one of the specific legitimate uses listed in Section 7.
Meaning of Legitimate Interest
Under the DPDP Act, processing needs consent or a listed legitimate use. There is no general "legitimate interest" or "contract" ground. Do not confuse "legitimate uses" in Section 7, which is a closed list, with GDPR's open-ended legitimate interest.
Under the GDPR, a controller may process personal data where it is necessary for the controller's own legitimate interests, unless those interests are overridden by the rights and freedoms of the individual. In practice the controller runs a three-step balancing test: identify the interest, show the processing is necessary for it, and weigh it against the individual's expectations. Fraud prevention, direct marketing to existing customers and internal analytics are classic examples.
The DPDP Act 2023 deliberately did not copy this ground. Section 4 allows processing of digital personal data only for a lawful purpose and only with the Data Principal's consent or for certain legitimate uses. Section 7 sets out those uses as a closed list from (a) to (i), including voluntary provision of data for a stated purpose, State benefits and functions, legal disclosures, court orders, medical emergencies, epidemics, disasters and employment. A business cannot add a tenth item by arguing its interest is reasonable.
The wording causes confusion because the English phrase "certain legitimate uses" sounds similar. The difference is structural. Section 7 asks whether the situation fits a pre-defined category, and there is no balancing exercise for the fiduciary to perform. Contract necessity, which GDPR treats as a separate ground, is also absent, so a retailer cannot say it needs to process an address merely because a sale contract exists. It must rely on consent or on a Section 7 use, such as the data being voluntarily provided for that very purpose.
Multinational groups often carry a GDPR record of processing activities that cites legitimate interest for dozens of activities. Those entries cannot be copied across to India. Each activity touching digital personal data in India, or connected to offering goods or services to people in India under Section 3, has to be re-mapped to consent or to a specific Section 7 clause, or redesigned so that it no longer needs personal data.
Examples of Legitimate Interest
A company that relied on legitimate interest in Europe for analytics must find consent or a Section 7 use in India.
A software company with European customers relies on legitimate interest for product analytics. For its Indian users it moves analytics to an opt-in consent request, explains the purpose in plain language, and turns off non-essential tracking for anyone who declines.
A retailer wants to email past buyers about similar products. It cannot treat this as a legitimate interest, so it adds a separate, unticked marketing consent at checkout and records the time and wording of each response.
A lender wants to profile transactions to detect fraud. It checks whether sectoral law or a legal obligation covers the work, and where it does not, it obtains consent through a clearly worded term, rather than assuming fraud prevention is automatically a free-standing ground.
Why Legitimate Interest matters
Because there is no balancing ground, the commercial cost falls on any activity that businesses in other countries run quietly in the background: behavioural analytics, cross-selling, enrichment of customer profiles, and sharing data with group companies. If none of these fits Section 7, each needs a clear consent request under Section 6 with an itemised notice under Section 5 and Rule 3.
The exposure for getting this wrong is real. Processing without a valid ground is a breach of the Act, and the Board can impose a penalty of up to ₹50 crore for a breach not covered by a more specific entry in the Schedule. Beyond the fine, an organisation that relied on an imagined ground may have to stop the processing and delete data it has built products on, so mapping grounds early is far cheaper than unwinding later.
How it works in practice
- 1Prepare an inventory of every purpose for which you process personal data, and record against each one the Section 4 basis you rely on: consent or a named clause of Section 7.
- 2For any purpose currently justified in a GDPR document as legitimate interest, decide whether to collect consent, to fit it into a Section 7 clause that clearly applies, or to stop the activity for Indian users.
- 3Write purposes narrowly in the notice, because voluntary provision under Section 7(a) only covers the purpose the person had in mind when handing over the data.
- 4Build consent capture and withdrawal into the product, including a withdrawal path as easy as the consent path, so that marketing and analytics can continue on a valid footing.
- 5Train legal and product teams that a GDPR assessment does not transfer, and review global policies for wording that quietly assumes a balancing test.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming the GDPR assessment on file is enough: the Indian law has no balancing test, so the same activity may need fresh consent or a different design.
Reading Section 7 as if it were an open list: the nine clauses are exhaustive, and a business purpose that does not fit one of them is not covered.
Treating a signed customer contract as permission to process everything: the Act has no contract ground, so processing beyond what the person voluntarily provided needs consent.
Compliance tips
Keep one lawful-basis register per purpose, and review it whenever a team proposes a new use of existing data.
Where Section 7(a) is your basis, keep evidence that the person provided the data voluntarily and did not object to its use for that purpose.
Do not rely on a vague general consent. Split purposes so that withdrawal of one does not affect the others.
Common questions about Legitimate Interest
Does the DPDP Act have a legitimate interest ground?
No. Section 4 allows processing only on consent or for certain legitimate uses listed in Section 7. There is no general ground that lets a business weigh its own interests against the person's rights.
Is "certain legitimate uses" the same as legitimate interest?
No. Section 7 is a closed list of defined situations such as medical emergencies or employment. The GDPR concept is open-ended and depends on a balancing test. The similarity is only in the words.
Can I process data for fraud prevention without consent?
Only if the activity fits a Section 7 clause or another law requires it. Fraud prevention is not a separate ground in the Act. This is general information, so check your facts with a qualified adviser.