Certain legitimate uses
Certain legitimate uses are specific situations in Section 7 where processing may proceed without relying on Section 6 consent.
The grounds include specified voluntary provision, medical emergencies, employment purposes and State functions, each with conditions. This is not GDPR's general legitimate-interest balancing test or a universal contractual basis.
Practical application
Record the precise Section 7 clause and why its conditions apply.
Common questions and examples
When is processing without consent allowed under the DPDP Act?
Section 4 permits processing for a lawful purpose on consent or one of the specific Section 7 grounds. Examples include a qualifying medical emergency, specified employment purposes and data voluntarily supplied for a particular purpose. Each ground has conditions; a business cannot simply label all useful processing a legitimate use.
What is an example of a legitimate use, and what falls outside it?
A customer voluntarily supplies an email address to receive a requested receipt and has not indicated refusal of that use. Using it for that specified purpose may fit Section 7(a). Adding the address to an unrelated advertising campaign is a separate purpose and needs its own valid processing ground. Keep the purpose, applicable clause and reasoning in the processing record.
Are contract performance and legitimate interests separate DPDP grounds?
The Act does not reproduce the GDPR list of lawful bases. A contract or a business-interest assessment does not by itself establish a general DPDP ground. Test the actual activity against consent or an applicable Section 7 clause. Research and archiving have a separate conditional exemption in Section 17(2)(b).
Related concepts
Official sources and editorial review
Prepared by DPDPA Shield. Explanations are plain-language summaries; the cited legislation controls. Last reviewed .
Put privacy knowledge into practice
Explore consent, data inventory and rights-request workflows with DPDPA Shield.