Section 7

Certain legitimate uses

The closed list of situations where personal data may be processed without consent, from voluntary provision to medical emergencies and employment.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(a): The specified purpose for which the Data Principal voluntarily provided her data and has not indicated that she does not consent.
(b): State provision of a subsidy, benefit, service, certificate, licence or permit, subject to prior consent or to the data being available in a notified State database.
(c): Performance of a State function under law, or processing in the interest of the sovereignty and integrity of India or the security of the State.
(d): Meeting a legal obligation to disclose information to the State.
(e): Compliance with a judgment, decree or order.
(f): Responding to a medical emergency involving a threat to life or an immediate threat to health.
(g): Providing medical treatment or health services during an epidemic, outbreak or other threat to public health.
(h): Providing safety, assistance or services during a disaster or a breakdown of public order.
(i): Employment purposes, or safeguarding the employer from loss or liability, including preventing corporate espionage and protecting trade secrets and intellectual property.

In practice

Clause (i) is the one most businesses can actually use, and it is narrower than it looks: it covers processing for employment purposes and for protecting the employer, not general analytics on employee data. Clause (a) is not a catch-all either, since the purpose still has to be the one the data was volunteered for.

s.4Grounds for processing personal dataPersonal data may be processed for a lawful purpose on one of exactly two grounds: consent, or a listed legitimate use.s.6ConsentSets the standard for valid consent, the right to withdraw it as easily as it was given, and the rule that the Data Fiduciary carries the burden of proving both.Rule 5Processing for State subsidy, benefit, service or licenceApplies the Second Schedule standards to State processing under Section 7(b) and defines the terms that trigger it.Sch. IIStandards for State processing and for the research exemptionThe seven standards that State processing under Section 7(b) and exempt research processing must both meet.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 7 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

I have read the notice below and I consent to Gevox using my email address to send me the DPDP brief.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy

What it says

In practice

Read next