Section 7 — DPDP Act, 2023
Notwithstanding anything contained in section 6, a Data Fiduciary may process personal data of a Data Principal for the following purposes, namely: (a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and she has not indicated that she does not consent to the use of her personal data; (b) by the State or its instrumentalities for subsidy, benefit, service, certificate, licence or permit; (c) for performance of any function under any law or judgment; (d) in response to a medical emergency or threat to life; (e) for provision of health services or safety measures during an epidemic, outbreak or similar threat; (f) for employment purposes; (g) for ensuring safety of, or providing assistance in, an emergency or disaster; (h) for purposes relating to research, archiving or statistical purposes; (i) for any other purpose as may be prescribed by the Central Government.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 7 is a closed list — not an open-ended 'legitimate interests' balancing test. If your processing activity does not fit within one of these nine enumerated purposes, you cannot use Section 7 as your lawful basis. You need consent. Sub-section (a) is the most commonly misread: it covers the case where a Data Principal voluntarily gives you their data without explicitly consenting (e.g., typing an email into a contact form). It does not authorise processing beyond the purpose for which the data was voluntarily shared. Sub-section (f) covers employment data — but only to the extent necessary for employment purposes, not for ancillary activities like marketing to employees.
A Data Principal submits a support ticket to a software company, typing their name, email, and problem description. The company can use this data to resolve the support ticket (the purpose for which it was voluntarily provided) without separately obtaining consent. It cannot use that email to send a marketing newsletter — that is a different purpose requiring consent.
A bank is required by RBI circular to collect and retain KYC data. Processing KYC data for compliance with the RBI direction is a legitimate use under Section 7(c). The bank does not need separate DPDP consent for this processing, but it still needs to issue a Section 5 notice disclosing this processing activity.
An HR department processes employee salary data (necessary for payroll — legitimate use). The same HR department wants to use employee photos in a company marketing brochure. Marketing is not an employment purpose — a separate consent is required from each employee.