Consent is the DPDP Act's main basis for processing — but not the only one. Section 7 lists a set of 'legitimate uses' where you may process without fresh consent. Knowing the line saves you from asking for consent you don't need — and from relying on an exception that doesn't apply.
What 'legitimate uses' cover
Section 7 includes, among others: data a person voluntarily provides for a purpose (and hasn't objected to that use); certain employment purposes; specified state functions and legal obligations; medical emergencies and threats to public health; and disaster or safety situations.
Where it stops
These are narrower than GDPR's 'legitimate interests' — there is no broad balancing test. If your purpose isn't on the list, you need consent. Marketing, profiling, cross-selling and most data-sharing are not legitimate uses.
The 'voluntarily provided' trap
A person giving you data for one purpose does not license every purpose. The legitimate use covers the purpose they provided it for — stretching it to unrelated uses is where businesses get caught.
Employment uses — useful but limited
Employers get specific employment legitimate uses (see HR & employee data), but anything beyond them still needs consent.
Be explicit about your basis
For each processing activity, write down whether you rely on consent or a specific legitimate use — and make your notice match. Ambiguity is risk.
How DPDP Bridge helps
DPDP Bridge helps you classify each activity by its lawful basis — consent or legitimate use — and align your notices and records to it. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.