Lawful Processing of Data
Under the DPDP Act 2023, personal data can only be processed on two lawful bases: (1) the consent of the Data Principal (Section 6), or (2) certain legitimate uses listed in Section 7. Unlike GDPR, there is no general "legitimate interests" basis � the legitimate uses are a closed list. This guide explains both bases, the requirements for valid consent, the Consent Manager framework, and real-world examples.
Important: Only Two Lawful Bases
The DPDP Act 2023 has only two lawful bases for processing � consent and legitimate uses. Unlike GDPR, there is no "contract performance", "vital interests", "public function", or "legitimate interests" basis. Those concepts are folded into specific legitimate uses under Section 7.
The Two Lawful Bases at a Glance
Consent
Section 6The Data Principal has given consent for the processing of their personal data. Consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. It must be limited to the specified purpose and must be as easy to withdraw as to give.
Certain Legitimate Uses
Section 7The Act lists specific situations where personal data can be processed without consent. Unlike GDPR, there is no general "legitimate interests" basis � the legitimate uses are a closed list. These include state functions, legal obligations, medical emergencies, employment, and public interest.
1. Consent (Section 6)
Consent is the primary lawful basis under the DPDP Act. It is the Data Principal's active, affirmative choice to allow processing of their personal data for a specific purpose. Consent is not a one-time event � it is an ongoing relationship that the Data Principal can withdraw at any time.
The Act sets out six requirements for valid consent. If any of these is missing, the consent is invalid � and any processing based on it is unlawful.
The 6 Requirements for Valid Consent
Free
The Data Principal must have a genuine choice. Consent obtained through coercion, deception, or undue influence is not valid.
Specific
Consent must be for a specific purpose, not a blanket consent for all processing. Each purpose requires separate consent.
Informed
The Data Principal must be given clear, plain-language information about what data is being collected and why.
Unconditional
Consent cannot be conditioned on the provision of a service unless the processing is necessary for that service.
Unambiguous
There must be a clear affirmative action (e.g., ticking a box). Silence, pre-ticked boxes, or inactivity is not consent.
Withdrawable
The Data Principal must be able to withdraw consent as easily as they gave it. Withdrawal must be respected immediately.
Consent Withdrawal
Under Section 6(4), the Data Principal can withdraw consent at any time. The process to withdraw must be as easy as the process to give consent. Once withdrawn, the Data Fiduciary must cease processing (unless another lawful basis applies).
Important: Withdrawal does not affect the legality of processing done before withdrawal. But it does mean the Data Fiduciary must stop processing and may need to erase the data.
2. Certain Legitimate Uses (Section 7)
Section 7 lists seven specific situations where personal data can be processed without consent. These are called "legitimate uses." They are a closed list � if a situation is not listed, consent is required.
This is a critical difference from GDPR, which has an open-ended "legitimate interests" basis. Under the DPDP Act, there is no such open-ended basis. This makes compliance simpler in some ways (the list is clear) but harder in others (marketing, analytics, and personalization all require consent).
Voluntary Provision of Data
Section 7(a)The Data Principal has voluntarily provided their personal data to the Data Fiduciary for a specified purpose, and has not indicated that they do not consent to such processing.
State Functions
Section 7(b)Processing is necessary for the performance of any function by the State under law, including the provision of subsidies, benefits, services, certificates, licences, or permits.
Legal Obligations
Section 7(c)Processing is necessary for compliance with any judgment or order of a court or tribunal, or for the performance of a legal obligation.
Medical Emergencies
Section 7(d)Processing is necessary for a medical emergency involving a threat to the life or health of the Data Principal or any other individual.
Disasters & Public Health
Section 7(e)Processing is necessary for taking measures during a disaster or public health emergency, or for the safety of the public.
Employment Purposes
Section 7(f)Processing is necessary for the purposes of employment, including recruitment, verification, and providing benefits to employees.
Public Interest
Section 7(g)Processing is necessary for research, archiving, or statistical purposes, where the data is not used to make decisions about specific individuals.
3. Consent vs. Legitimate Use
Understanding the difference between these two bases is essential for compliance. Here is a side-by-side comparison:
| Aspect | Consent | Legitimate Use |
|---|---|---|
| Nature | Active, affirmative choice by the Data Principal | Specific situation listed in Section 7 |
| Withdrawal | Can be withdrawn at any time | Cannot be withdrawn |
| Scope | Limited to the specific purpose | Narrow, closed list |
| Notice | Notice must be given before seeking consent | Notice requirements may be relaxed |
| Flexibility | Broad � can cover most processing | Narrow � only the listed uses |
| Examples | Marketing, analytics, personalization | Legal obligations, medical emergencies, employment |
4. Consent Manager (Section 6(7))
The Act introduces a novel concept called a Consent Manager. A Consent Manager is an entity registered with the Data Protection Board that acts as a single point of contact for Data Principals to give, manage, review, and withdraw consent across multiple Data Fiduciaries.
Think of it as a "consent dashboard" � instead of managing consent separately with every website and app, a Data Principal can use a Consent Manager to manage all their consents in one place. This is especially useful for consumers who deal with dozens of online services.
Consent Managers must be accountable to Data Principals and must not misrepresent information. They must be registered with the Board and comply with technical and operational standards prescribed by the government.
The Consent Manager framework is still being operationalised. Once fully live, it could significantly simplify consent management for both consumers and businesses.
5. Real-World Examples
To make this concrete, here are examples of what is and is not a lawful basis:
Consent: Marketing Emails
A retail company wants to send marketing emails to its customers. It must obtain specific consent for this purpose, with a clear opt-out mechanism. The customer can withdraw consent anytime.
Legitimate Use: State Subsidies
A government department processes personal data to verify eligibility for a subsidy scheme. This is a legitimate use under Section 7(b) � state functions � and does not require consent.
Legitimate Use: Medical Emergency
A hospital processes a patient's data in an emergency without consent. This is a legitimate use under Section 7(d) � medical emergency � and is permitted.
Legitimate Use: Employment Records
An employer processes employee data for payroll, benefits, and verification. This is a legitimate use under Section 7(f) � employment purposes � and does not require fresh consent.
NOT Legitimate Use: Marketing
A company wants to use customer data for marketing. There is NO legitimate use for marketing under Section 7. Consent is required.
NOT Legitimate Use: Analytics
A website wants to use user data for analytics. There is NO legitimate use for analytics under Section 7. Consent is required.
6. Practical Guidance for Businesses
Map your processing activities
For each processing activity, identify whether it is based on consent or a legitimate use. If it is neither, you need to reconsider.
Default to consent where possible
Consent is the broadest and most flexible basis. Where a legitimate use does not clearly apply, obtain consent.
Build consent withdrawal into your product
Consent withdrawal must be as easy as giving consent. Build this into your UX from day one.
Do not rely on "legitimate interests"
There is no general legitimate interests basis under DPDP. Marketing, analytics, and personalization all require consent.
Document your legitimate use justification
If you rely on a Section 7 legitimate use, document why. The Board may ask for justification during an inquiry.
Prepare for Consent Managers
As Consent Managers become operational, ensure your systems can integrate with them for consent management.
Shilpi Kulshrestha
Founder, BusinezExcellence | Corporate Law & Company Secretary Expert
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy governance, and AI compliance.
Frequently Asked Questions
What are the lawful bases for processing under the DPDP Act 2023?+
The DPDP Act 2023 has only two lawful bases: (1) Consent of the Data Principal (Section 6), and (2) Certain Legitimate Uses listed in Section 7. Unlike GDPR, there is no general "legitimate interests" basis.
What is valid consent under the DPDP Act?+
Consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. It must be limited to the specified purpose, and the Data Principal must be able to withdraw it as easily as they gave it.
What are the legitimate uses under Section 7 of the DPDP Act?+
Section 7 lists legitimate uses: (a) voluntary provision of data for a specified purpose, (b) state functions, (c) legal obligations, (d) medical emergencies, (e) disasters or public health emergencies, (f) employment purposes, and (g) public interest (research, archiving, statistical purposes).
What is a Consent Manager under the DPDP Act?+
A Consent Manager is an entity registered with the Data Protection Board that acts as a single point of contact for Data Principals to give, manage, review, and withdraw consent across multiple Data Fiduciaries.
Can consent be withdrawn after giving it?+
Yes. Under Section 6(4), a Data Principal can withdraw consent at any time. The process to withdraw must be as easy as the process to give. Withdrawal does not affect the legality of processing done before withdrawal, but the Data Fiduciary must cease processing after withdrawal.
What is the difference between consent and legitimate use?+
Consent is an active, affirmative choice by the Data Principal. Legitimate use is a specific situation listed in Section 7 where processing can occur without consent. Legitimate uses are narrower than GDPR's legitimate interests � they are a closed list, not an open balancing test.
What notice must a Data Fiduciary provide before seeking consent?+
The notice must be clear, independent, and in plain language. It must describe the personal data being collected, the specific purpose of processing, how the Data Principal can exercise their rights, and how to file a complaint with the Data Protection Board.
Does the DPDP Act apply to processing for employment purposes?+
Yes. Section 7(f) allows processing for employment purposes, including recruitment, verification, and providing benefits to employees. However, the employer must still comply with the Act's other obligations � such as security safeguards and grievance redressal.
Related Topics
Rights of Data Principals
How Data Principals can control their data.
Obligations of Data Fiduciaries
What businesses must do to comply.
Penalties & Offences
Penalties for unlawful processing.
Key Provisions
Chapter-wise overview of the Act.
Data Protection Board
The authority that enforces the Act.
DPDPA Complete Guide
End-to-end guide to the Act.
Is your consent mechanism DPDPA-ready?
Take our free assessment to see if your consent collection and withdrawal mechanisms meet the requirements of the DPDP Act 2023.
Disclaimer: This page is for educational and informational purposes only. It is not legal advice. For advice on your specific situation, consult a qualified legal professional.