Processing Without Consent: The Legitimate Uses in Section 7

Introduction

Most businesses meet the Digital Personal Data Protection Act, 2023 (the DPDP Act) through its consent rules. Section 4 offers a second route: a data fiduciary (the business that decides why and how personal data is processed) may rely on "certain legitimate uses" listed in s.7.

Those uses decide much of what a business can do without asking. They also decide which rights the data principal (the person the data is about) can claim. Section 7 commences on 13 May 2027 with most of the Act. This article reads each clause, sets s.7 beside the s.17 exemptions and brings Trayambic's positions across its industry studies into one table.

The legal position

Section 7 opens: "A Data Fiduciary may process personal data of a Data Principal for any of following uses". Nine clauses follow.

• (a) Voluntary provision. For "the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary", where she "has not indicated to the Data Fiduciary that she does not consent" to that use. Illustration (I): a customer gives a pharmacy her number and asks for a payment receipt by message; the pharmacy "may process the personal data of X for the purpose of sending the receipt". Illustration (II): a woman messages a real estate broker for help finding a rented flat; the broker may use her data to tell her about flats, and once she says she no longer needs help it "shall cease to process" her data.
• (b) State benefits. For the State to provide a prescribed subsidy, benefit, service, certificate, licence or permit, where she earlier consented to State processing for such benefits or her data is in a notified State database. Its illustration: a woman enrolled for maternity benefits may be assessed for other prescribed benefits.
• (c) State functions. For the State performing "any function under any law" in India, or in the interest of sovereignty, integrity or the security of the State.
• (d) Disclosure to the State. For "fulfilling any obligation under any law" in India "on any person to disclose any information to the State or any of its instrumentalities", in line with that law's disclosure provisions.
• (e) Judgments and orders. For compliance with "any judgment or decree or order issued under any law" in India, or a foreign judgment or order on contractual or civil claims.
• (f) Medical emergencies involving a threat to the life, or an immediate threat to the health, of the data principal "or any other individual".
• (g) Epidemics. Treatment or health services for any individual during an epidemic, outbreak or other threat to public health.
• (h) Disasters and public order. Safety, assistance or services for any individual during a disaster, as defined in the Disaster Management Act, 2005, or a breakdown of public order.
• (i) Employment. For "the purposes of employment or those related to safeguarding the employer from loss or liability", with examples such as corporate espionage, and for "any service or benefit sought by a Data Principal who is an employee".

"State" means the State under Article 12 of the Constitution (s.2(zb)), so (b) and (c) are closed to private businesses. Trayambic's study on government bodies and PSUs covers them.

Three neighbouring provisions matter. Notice under s.5(1) attaches only to a request "for consent". Access (s.11) and correction and erasure (s.12) run only against a fiduciary to which she "has previously given consent, including consent as referred to in clause (a) of section 7". And s.17(1) disapplies Chapter II (except ss.8(1) and 8(5)), Chapter III and s.16 where, among other cases, processing is "necessary for enforcing any legal right or claim" (a), serves the prevention, detection, investigation or prosecution of an offence or contravention (c), or ascertains a loan defaulter's assets and liabilities (f).

Analysis

A closed list, with no legitimate interests

Section 4 permits processing on consent or a s.7 use, and s.7 says "any of following uses", not "including". There is no legitimate-interests ground of the GDPR kind, no general contract ground and no general compliance-with-law ground: (d) reaches only disclosures to the State, and (e) only judgments and orders. Commercial interest alone is never enough.

Where law demands processing that no clause covers, two provisions help: s.6(6) lets processing continue after withdrawal where "required or authorised" by law, and s.8(7) allows retention "necessary for compliance with any law". Both assume a valid ground at collection.

Section 7(a): two conditions, and a purpose to pin down

Condition one: her data, handed to this fiduciary. The clause covers data she "has voluntarily provided" to the fiduciary. A gift recipient's address, a co-traveller's passport or a spouse's income typed in by someone else fails it, and so does anything a business acquires from a list vendor, a partner or the open web. In our view, data generated in delivering the service she asked for, such as meter readings or a video stream, stays within the purpose; tracking outside the task does not.

Condition two: no contrary indication. The ground lasts until she tells the fiduciary she does not consent, as Illustration (II) shows. In our view her indication works like withdrawal: stop that use for the future and erase under s.8(7) unless law requires retention.

Section 2(za) defines "specified purpose" as the purpose mentioned in the fiduciary's notice, yet s.5 requires notice only for consent. In both illustrations the person's own request fixes the purpose. In our view the prudent course is to state the purpose in writing at collection, which both limits and evidences the s.7(a) use.

In our view, "voluntarily" does not mean free of legal compulsion. A customer who hands over KYC documents to open an account chose the service, which is why Trayambic's banking and telecom studies rest account data on s.7(a).

The ground decides the rights

Because s.11(1) treats s.7(a) as a form of consent, people processed under it hold access, correction and erasure rights. People processed only under (b) to (i) do not; Trayambic's article on employee monitoring applies this to staff under s.7(i). Rule 14(2) omits the s.7(a) words, but in our view a rule cannot narrow the Act. Grievance redressal (s.13) and nomination (s.14) apply whatever the ground, as do the s.8 duties on security, accuracy and erasure.

Exemptions that work like grounds

Section 17(1) is not a legitimate use but does similar work, and more. It switches off Chapter II, which contains s.4 itself, so in our view exempt processing needs no ground; it also escapes notice, children's rules, breach intimation, erasure and the Chapter III rights. Only processor accountability (s.8(1)) and security (s.8(5)) survive.

Three cautions follow. The exemptions attach to a purpose, not a dataset: footage kept to detect theft is exempt, the same footage used to time a cleaner's arrival is not. They end when the purpose ends; s.17(1)(a) lapses with the claim. And s.17(1)(f) reaches only someone who defaulted on a loan or advance from a financial institution, as the Insolvency and Bankruptcy Code defines both terms, and only within other laws' disclosure rules.

In our view s.17(1)(c) turns on purpose rather than on who processes, so private businesses can use it; Trayambic's cybersecurity study explains why. Where both a s.7 use and an exemption fit, record both, with the offence or claim the exemption serves.

Common business uses and their grounds

Practical implications

Worked example (illustrative). A 140-person Indian SaaS company sells an AI customer-support assistant to retailers and lenders. Its map reads:

• Clients' customers' messages in tickets. The company is a data processor (acting on the client's behalf) under the client's ground. Training its general model on them is a purpose of its own, needing client instructions and end-user consent, as Trayambic's AI training article explains.
• Client administrators' accounts and billing. s.7(a), with the purpose stated on the sign-up page.
• Product analytics and upsell nudges. Consent, as Trayambic's SaaS study concludes. Logs needed to run the service stay within s.7(a) and intrusion detection within s.17(1)(c), kept for the year Rule 6 requires.
• Webinar sign-ups. s.7(a) for the webinar; the newsletter needs a separate tick.
• Staff and candidates. s.7(i) for staff, without screenshot scoring; s.7(a) for applications to a named role; consent for background checks.
• GST and TDS filings. s.7(d), with invoices kept for 72 months under s.8(7).
• A sole proprietor's unpaid invoices. s.17(1)(a) once a legal notice issues.

The result: administrators, webinar attendees and candidates hold ss.11 and 12 rights; staff under s.7(i) do not, so the company offers them HR-portal access anyway.

Key takeaways

Section 7 is a closed list, and for most private businesses only s.7(a), (d), (e) and (i) carry everyday weight. Use s.7(a) with a written purpose and a way to stop, treat s.17 as a purpose-bound exemption rather than a ground, and remember that the clause chosen fixes the rights people hold.

• Section 7 is a closed list with no legitimate-interests, contract or general legal-obligation ground; State uses in (b) and (c) are closed to private businesses.
• Section 7(a) needs data the person gave this business herself, for a purpose, without objecting; state the purpose in writing because s.2(za) ties it to a notice.
• Access, correction and erasure under ss.11 and 12 follow consent and s.7(a) only; grievance, nomination and s.8 duties apply whatever the ground.
• Section 17(1) exemptions remove the need for a ground and most duties, but only for their purpose and only while it lasts; security and processor duties remain.
• Record one ground per purpose: s.7(d) for filings, s.7(e) for orders, s.7(i) for staff, s.17(1)(c) for security and fraud, consent for marketing and AI training.