Section 4 — DPDP Act, 2023
(1) A Data Fiduciary may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose— (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses. (2) A lawful purpose means any purpose which is not expressly forbidden by law.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 4 collapses the entire question of lawful basis down to exactly two doors: consent (Section 6) or a legitimate use (Section 7). There is no third door. Unlike GDPR's six lawful bases — which include 'legitimate interests' as a flexible catch-all — the DPDP Act's legitimate uses under Section 7 are a closed list of nine specific scenarios. If your processing activity does not fit within Section 7's closed list, you need consent. There is no self-assessed 'legitimate interest' balancing test available to Data Fiduciaries.
A fintech company that runs fraud analytics on transaction data cannot rely on a GDPR-style 'legitimate interests' basis. Under the DPDP Act, it must either obtain consent for fraud analytics as a disclosed purpose, or fit the processing within one of Section 7's nine legitimate uses (e.g., compliance with a law or judgment).
A hospital can process patient data under consent (Section 6) for general healthcare services and under a legitimate use (Section 7 — compliance with a law) for mandatory disease reporting to health authorities. The bases operate independently for each processing activity.