Section 7 of the Digital Personal Data Protection Act, 2023 - Certain Legitimate Uses

Section 7 of the Digital Personal Data Protection Act, 2023 (DPDP Act) identifies circumstances in which a Data Fiduciary may process a Data Principal's personal data for certain legitimate uses. These grounds operate separately from consent, but remain subject to the Act when the relevant provisions come into force.

Commencement status as on 24 September 2026: Section 7 is not yet in force. Under the Central Government's commencement notification dated 13 November 2025, sections 7 to 10 are in the group scheduled to commence on expiry of eighteen months from publication of that notification. The resulting calendar date is commonly calculated as 13 May 2027; the notification itself states the period rather than a calendar date.
On this page

What does Section 7 mean?

The DPDP Act generally contemplates processing of personal data for a lawful purpose on the basis of consent or for a "certain legitimate use". Section 7 sets out the latter category. It covers specified situations including voluntary provision of data for a requested purpose, specified State functions and benefits, legal disclosure obligations, compliance with court orders, medical emergencies, public-health situations, disasters and certain employment-related purposes.

Section 7 should therefore be read together with Section 4 on grounds for processing personal data, Section 6 on consent, and Section 8 on general obligations of a Data Fiduciary.

Section 7: Certain legitimate uses

A Data Fiduciary may process personal data of a Data Principal for any of the following uses, namely:

(a) Voluntarily provided personal data: for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data.

Illustration IX makes a purchase at Y, a pharmacy, voluntarily provides personal data and asks Y to acknowledge the payment by sending a message to her mobile phone. Y may process X's personal data for sending the receipt.
Illustration IIX messages Y, a real estate broker, asking for help to identify rented accommodation and shares personal data for that purpose. Y may use the data to identify and communicate available accommodation. If X later says that she no longer needs Y's help, Y must cease processing X's personal data for that purpose.

(b) State benefits, services and permits: for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, where the statutory conditions in clause (b) are satisfied. These conditions include previous consent in the circumstances stated in sub-clause (i), or availability of the data in a qualifying State database, register, book or other document under sub-clause (ii), subject to the prescribed statutory framework.

Statutory illustrationA pregnant woman enrols on an app or website for a government maternity-benefit programme and consents to provide personal data for that purpose. The Government may process the data to determine eligibility for another prescribed government benefit, subject to the statutory conditions.

(c) State functions, sovereignty and security: for performance by the State or any of its instrumentalities of any function under a law in force in India, or in the interest of the sovereignty and integrity of India or security of the State.

(d) Disclosure required by law: for fulfilling an obligation imposed by a law in force in India on any person to disclose information to the State or any of its instrumentalities, subject to the disclosure requirements of the applicable law.

(e) Judgments, decrees and orders: for compliance with a judgment, decree or order issued under a law in force in India, or a judgment or order relating to contractual or civil claims under a law in force outside India.

(f) Medical emergency: for responding to a medical emergency involving a threat to the life or an immediate threat to the health of the Data Principal or another individual.

(g) Epidemic or public-health threat: for taking measures to provide medical treatment or health services to an individual during an epidemic, outbreak of disease or another threat to public health.

(h) Disaster or breakdown of public order: for taking measures to ensure an individual's safety or to provide assistance or services during a disaster or breakdown of public order. For this clause, "disaster" carries the meaning assigned in clause (d) of section 2 of the Disaster Management Act, 2005.

(i) Employment-related purposes: for purposes of employment or purposes related to safeguarding an employer from loss or liability, including prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property or classified information, or provision of a service or benefit sought by a Data Principal who is an employee.

Important terms used in Section 7

Data Principal: under Section 2, the individual to whom the personal data relates; where the individual is a child, the expression includes the parent or lawful guardian, and where the individual is a person with disability, it includes the lawful guardian acting on her behalf.

Data Fiduciary: a person who alone or together with other persons determines the purpose and means of processing personal data.

Personal data: any data about an individual who is identifiable by or in relation to such data.

Processing: a wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, indexing, sharing, disclosure, dissemination, restriction, erasure or destruction.

Practical scope of Section 7

Section 7 does not create a general or unlimited "legitimate interests" ground. Processing must fit within one of the specific statutory situations listed in clauses (a) to (i). The purpose and surrounding facts therefore matter. For example, data voluntarily supplied to obtain a requested service may be processed for that specified purpose under clause (a), but the statutory illustration also makes clear that processing should cease when the individual withdraws the request in the circumstances illustrated.

Clause (b) is also linked to subordinate legislation because Section 40(2)(e) authorises rules concerning the subsidy, benefit, service, certificate, licence or permit for which personal data may be processed under Section 7(b). The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and have a phased commencement schedule.

Compliance note: The DPDP framework is being brought into force in phases. Before relying on Section 7 operationally, check the applicable commencement notification, the provisions of the Act then in force, and the corresponding rules in force on the relevant date.

Official resources

For authoritative and updated material, refer to the Government sources in the right-side panel, including India Code and the Ministry of Electronics and Information Technology. The original page's canonical URL, internal section links, advertising code and analytics code have been retained.