Certain Legitimate Uses
The listed situations in Section 7 where personal data can be processed without consent.
Certain legitimate uses are the specific situations listed in Section 7 of the DPDP Act where an organisation may use personal data without asking for consent. The list is closed, so a use that is not on it needs consent.
Meaning of Certain Legitimate Uses
The list includes data a person voluntarily provides for a stated purpose (unless she says she does not consent), State subsidies and benefits, State functions, legal obligations to disclose to the State, court orders, medical emergencies, epidemics, disasters and public order, and employment purposes. The list is closed and each ground has limits, so organisations cannot use it as a general escape from consent.
Section 4 gives two grounds for processing: consent, or certain legitimate uses. Section 2 defines "certain legitimate uses" as the uses listed in Section 7. There are nine: data voluntarily provided for a specified purpose (clause a); State subsidies, benefits and permits (b); State functions and security (c); legal disclosure to the State (d); court judgments and orders (e); medical emergencies (f); epidemics and public health threats (g); disasters and breakdown of public order (h); and employment purposes (i).
Each clause has its own limits. Clause (a) depends on the person having provided the data voluntarily for a specified purpose and not having told the Fiduciary that she does not consent. Clauses (b) to (e) are tied to State activity or legal compulsion, with conditions in the Rules. Clauses (f) to (h) respond to emergencies. Clause (i) applies to employers. None gives open-ended permission, and each should be read for its own words.
The big difference from the GDPR is what is missing. The European regulation has a "legitimate interests" basis that lets a business balance its own interest against the individual's. The DPDP Act has no equivalent. Fraud analytics, product improvement and direct marketing cannot rely on an unnamed business interest; they need to fit a listed clause, such as Section 7(i) for an employer, or rest on consent.
Using a legitimate use does not remove every duty. Security safeguards under Section 8(5) and Rule 6, breach intimation under Section 8(6) and Rule 7, accuracy, retention and erasure under Section 8 still apply to the data. Sections 11 and 12 expressly extend access, correction and erasure rights to data processed under Section 7(a). The Section 5 notice is tied to consent requests, so check separately which transparency duties apply to each use.
Examples of Certain Legitimate Uses
A person who gives her address to order a parcel has voluntarily provided it for that purpose, so the seller can use it for delivery without asking for fresh consent.
A customer enters her address to receive a parcel. The retailer uses the address for delivery under Section 7(a) without extra consent, but adding her to a promotional mailing list would need a separate, consent-based request.
A software company processes bank details and tax identifiers of staff to run payroll and statutory filings under the employment clause. It does not use the same file to build an unrelated staff-lifestyle survey, which would sit outside the clause.
A patient is rushed in after an accident and cannot speak. The hospital pulls her blood group and allergy history from a linked clinic for treatment under the medical emergency clause and records why access was needed.
Why Certain Legitimate Uses matters
Choosing the wrong ground is a structural error. If a team treats marketing, profiling or secondary use as a "legitimate use" when it is not on the list, every record processed that way lacks a lawful basis under Section 4. Residual breaches carry penalties of up to ₹50 crore, and the Board will look at how long the misuse went on and what was done to correct it.
Used correctly, Section 7 spares both sides pointless consent prompts. A hospital can treat an unconscious patient, a company can pay salaries and an organisation can comply with a court order without a click. This keeps consent meaningful: because the list is short, a consent request stands for a real choice rather than a ritual.
How it works in practice
- 1For each processing activity, record the ground relied on: consent or the exact clause of Section 7. If it is a Section 7 clause, note the facts that bring the activity within it and who approved that view.
- 2Challenge broad use of clause (a). If the data was given for one purpose, restrict internal use to that purpose and ask for consent for anything additional.
- 3Apply minimisation inside each ground. An employer processing for payroll should not feed the same data into unrelated analytics, and an emergency record should be limited to what the emergency required.
- 4Keep applying the remaining duties: security safeguards, breach readiness, retention limits and a grievance route, because they do not depend on the ground.
- 5Review the register whenever a new product feature, vendor or data source is introduced, and revisit it after the Rules take effect on 13 May 2027.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating "legitimate use" as if it were the GDPR's legitimate interests. The Indian list is closed, and business convenience is not on it.
Stretching voluntary provision to any later use of data. Section 7(a) is tied to the specified purpose for which it was provided.
Assuming that no consent means no obligations. Security, breach, retention and rights duties continue to apply.
Forgetting the objection carve-out in clause (a). If the person says she does not consent, the clause does not cover continued use.
Compliance tips
Keep a ground-of-processing register and review it quarterly with legal, product and HR.
Where a use is borderline, prefer consent, as it is easier to defend than an aggressive reading of a clause.
Document the factual trigger for emergency and legal-order uses, with dates and who authorised them.
Explain the use in plain words in your notice or privacy information even when consent is not being sought.
Common questions about Certain Legitimate Uses
Is there a legitimate interest ground in the DPDP Act?
No. Unlike the GDPR, the DPDP Act has no general legitimate-interest basis. Section 4 allows processing on consent or on the specific certain legitimate uses in Section 7. A business purpose that is not on that list generally needs the person's consent.
How many legitimate uses does Section 7 list?
Section 7 lists nine, clauses (a) to (i): voluntary provision, State benefits, State functions, legal disclosures to the State, court orders, medical emergencies, epidemics, disasters or public-order breakdown, and employment purposes. The list is closed, and each clause comes with its own conditions.
Do I still need a privacy notice if I rely on a legitimate use?
Section 5 ties the notice duty to consent requests, but good practice is still to tell people how their data is used. Other obligations such as security, breach intimation, retention and rights handling apply regardless of the ground, so check each against your facts or take legal advice.