Can I rely on legitimate interest for marketing under the DPDPA?

No. The DPDP Act has a closed list of legitimate uses with no general legitimate-interests basis, so marketing, analytics and advertising generally require consent under Section 6.

Does Section 7 let employers process employee data?

It permits certain employment-related purposes, such as safeguarding the employer from loss or providing a service or benefit to the employee, within the bounds of the listed use.

DPDP Act · Section 7

DPDPA Section 7: Certain legitimate uses

DPDPA Section 7 explained: the limited legitimate uses that need no separate consent, and why most commercial processing still requires it.

In short

Section 7 of the DPDP Act lists certain legitimate uses where a data fiduciary may process personal data without separate consent, including data the person voluntarily provided for a purpose, the State providing benefits or services, compliance with law or court orders, responding to medical emergencies and disasters, and certain employment purposes. These are narrow exceptions; most ordinary commercial and marketing processing still relies on consent under Section 6.

Last updated 2026-06-03

What counts as a legitimate use

The legitimate uses include personal data a person has voluntarily provided for a specified purpose and not objected to, processing by the State or its instrumentalities to provide benefits, subsidies, services, certificates, licences or permits, compliance with a law or judgment, medical emergencies and threats to public health, disaster and public-order situations, and certain employment-related purposes.

Each use is purpose-bound. It permits the processing that fits the listed situation, not a general licence to use the data for anything.

How this differs from GDPR legitimate interests

Unlike the GDPR, which offers a broad legitimate-interests basis subject to a balancing test, the DPDP Act enumerates a closed list of legitimate uses. There is no open-ended legitimate-interests basis for marketing, analytics or profiling.

That is why, for most websites and apps, consent under Section 6 remains the route for cookies, analytics, advertising and personalization, and getting the consent flow right is central to compliance.

This page is a plain-English summary of the Digital Personal Data Protection Act, 2023 for general information and is not legal advice. Confirm your obligations with qualified counsel.

All DPDPA sections DPDP Act explained DPDPA overview ConsentX for India

Meet this DPDPA requirement with ConsentX

DPDPA-native consent, Section 9 age-gate and verifiable receipts. Start free or take the DPDPA quiz.

Get started free Take the DPDPA quiz

DPDPA Section 7 questions

More DPDPA sections

DPDPA Section 5: Notice DPDPA Section 6: Consent and withdrawal DPDPA Section 8: Duties of a data fiduciary DPDPA Section 9: Children's data DPDPA Section 10: Significant Data Fiduciaries DPDPA Sections 11-14: Data principal rights DPDPA penalties: Section 33 and the Schedule

ConsentX

What counts as a legitimate use

Each use is purpose-bound. It permits the processing that fits the listed situation, not a general licence to use the data for anything.

How this differs from GDPR legitimate interests

DPDPA Section 7 questions