s.7 · s.4
Legitimate uses
Section 7 lists the only situations in which personal data may be processed without consent, from data an individual provides voluntarily to employment, medical emergencies and State functions.
There is no general "legitimate interest" ground of the kind the GDPR has. The Indian list is closed. The one most businesses rely on is Section 7(a): the Data Principal voluntarily provided the data for a specified purpose and has not indicated that they do not consent to its use for that purpose.
Section 7(i) covers employment purposes and safeguarding the employer from loss, which is the ground for staff records and workplace security. The remaining items cover the State, medical emergencies, epidemics, disasters and court orders.
A marketing use, an analytics use or a data sale is not on the list. Those need consent.
Questions people ask
- Can we process customer data for marketing under legitimate uses?
- No. Marketing is not on the Section 7 list. It needs consent under Section 6.
- Does 7(a) cover a contact form?
- Usually. The person provided the data voluntarily for the purpose of being contacted. Using it for a newsletter they did not ask for is a different purpose.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.