Section 7: The Exhaustive List
Section 7 of the DPDPA enumerates specific situations where a Data Fiduciary may process personal data without the consent of the Data Principal. These are not "legitimate interests" in the GDPR sense — they are enumerated, specific legitimate uses. There is no general balancing test. Either the processing falls within one of the enumerated categories, or consent is required.
Scenario 1: Voluntary Provision for a Specified Purpose (Section 7(a))
Where the Data Principal voluntarily provides personal data and has not indicated that she does not consent, processing for the specified purpose is a legitimate use. The critical elements: "voluntarily" (not under compulsion), "specified purpose" (the purpose must be clear at the time of provision), and "has not indicated non-consent" (silence is deemed consent, but only for the specified purpose). For foreign companies, this applies to: voluntary form submissions, account registrations where the purpose is clear, and direct communications from the Data Principal.
Scenario 2: State Functions (Section 7(b))
Processing necessary for the State to provide benefits, services, certificates, licences, or permits. This is limited to State functions and does not apply to private companies unless they are performing a function on behalf of the State under a specific authorisation.
Scenario 3: Legal Obligations (Section 7(c))
Processing necessary for compliance with any law in force in India. For foreign companies, this covers: tax compliance (GST, income tax), regulatory reporting (RBI, SEBI, IRDAI), employment law obligations (PF, ESI), and anti-money laundering requirements. The processing must be genuinely necessary for the legal obligation — not merely convenient.
Scenario 4: Medical Emergencies (Section 7(d))
Processing necessary to respond to a medical emergency involving a threat to life or an immediate threat to the health of the Data Principal or any other individual. Limited to genuine emergencies — not general healthcare processing.
Scenario 5: Employment Purposes (Section 7(e))
Processing necessary for employment purposes, including prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information, recruitment, termination, provision of services or benefits to the employee, and verification of attendance. This is particularly relevant for global employers — but it is narrower than it appears. "Necessary for employment purposes" does not cover all HR analytics, behavioural monitoring, or employee scoring systems.
Scenario 6: Public Interest (Section 7(f))
Processing in public interest, including: mergers, acquisitions, or restructurings (specifically mentioned), preventing fraud, whistleblowing, and credit scoring. For foreign companies involved in Indian M&A, this legitimate use allows data processing during the transaction without requiring individual consent from every data principal whose data is part of the acquired entity.
The Misapplication Risk
The greatest risk for multinational companies is over-reliance on legitimate uses. Companies accustomed to GDPR's legitimate interests balancing test may attempt to apply a similar approach under DPDPA. This does not work. DPDPA's legitimate uses are enumerated and specific. Processing that does not fall squarely within one of the seven categories requires consent — regardless of how reasonable or proportionate the company believes the processing to be.
Documentation Requirements
Even where consent is not required, the Data Fiduciary must: (a) still provide a notice under Section 5 (the notice obligation applies regardless of the legal basis), (b) document which legitimate use applies to each processing activity, (c) ensure the processing does not exceed what is necessary for the legitimate use, and (d) implement all security safeguards under Section 8(4). Processing without consent does not mean processing without obligations.