Grounds for processing

Processing without consent is allowed, and narrower than it looks.

Q: Do we need consent to process employee data?

Often not, if it serves employment. The employment use covers processing for employment purposes, protecting the employer from loss or liability, and benefits an employee asks for. Processing beyond that, such as marketing an employee's photo, needs consent.

The Act gives two routes to lawful processing: consent, or one of a short list of legitimate uses. Separately, it exempts some processing from parts of the law, or from all of it. Each door is narrow, and each leaves duties behind it.

Back to DPDP services

01 · Two routes

Consent is one ground, not the only one

A legitimate use replaces consent. An exemption switches off parts of the Act.

Every processing activity needs a lawful purpose, meaning one that no law forbids, plus either consent or a legitimate use. Exemptions work differently: they do not supply a ground, they remove obligations for named situations. Mixing the two up is where most errors start.

Ground

Consent

Free, specific, informed and withdrawable. Needs a notice first. The default for most consumer processing.

Ground

Legitimate use

One of the nine uses the Act lists. No consent needed, but the rest of the Act still applies.

Carve-out

Exemption

Some or all of the Act does not apply to a defined situation or a notified body. Read the exact list of what is switched off.

02 · The nine uses

The nine legitimate uses, in plain words

Section 7 is a closed list. If your case is not on it, you need consent.

Voluntary sharing for a purpose: The person handed you the data for a specific purpose and has not said no to that use. A receipt by text after a purchase is the classic case.
State benefits and services: Government bodies issuing a subsidy, benefit, licence or permit, under conditions and the standards in the Rules.
State functions and security: The State performing a function under law, or acting for sovereignty, integrity or security.
Legal duty to disclose: Meeting an obligation under Indian law to give information to the State.
Court orders: Complying with an Indian judgment, decree or order, or a foreign one on a contractual or civil claim.
Medical emergency: Responding to a threat to life or an immediate threat to someone's health.
Epidemics: Treatment or health services during an epidemic or outbreak.
Disasters and public order: Safety and assistance during a disaster or a breakdown of public order.
Employment: Purposes of employment, protecting the employer from loss or liability, or a benefit an employee asked for.

The first use is the one private companies lean on most. It needs two things: the person volunteered the data for that purpose, and has not objected. Using it for anything beyond that purpose takes you back to consent.

03 · Exemptions

The exemptions in section 17, from partial to total

Some switch off a few duties; a few take the processing outside the Act.

17(1)
Partial: six named situationsEnforcing a legal claim; courts, tribunals and regulators doing their job; preventing or investigating offences; Indian firms processing foreign people's data under a foreign contract; court-approved mergers and schemes; tracing a loan defaulter's assets. Most of Chapters II and III and the transfer section stop applying.
17(2)(a)
Total: notified State bodiesInstrumentalities the government notifies for security, sovereignty, public order and similar grounds. The Act does not apply to their processing.
17(2)(b)
Total: research, archiving, statisticsOnly where the data is not used for a decision about a person, and the processing follows the standards in the Rules.
17(3)
Notified fiduciaries, including startupsClasses the government notifies by volume and nature of data can be freed from notice, accuracy, erasure, significant fiduciary and access duties.
17(4)
The State's own processingFreed from the erasure duty and the right to erasure, and from correction where no decision about the person is made.
17(5)
A five-year windowWithin five years of commencement, the government may disapply any provision for named fiduciaries for a set period.

Being a startup is not an exemption

Section 17(3) needs a government notification naming the class. Until one exists and covers you, a recognised startup carries the same duties as any other fiduciary.

04 · What still applies

Situation by situation: which family, and what survives

No route switches off everything except the total exemptions.

Situation	Provision family	What still applies
A customer gives a phone number for a delivery update	Legitimate use: voluntary sharing	Security safeguards, breach intimation, erasure once the purpose ends, grievance redressal, access and correction rights
Payroll and attendance records for staff	Legitimate use: employment	Security safeguards, breach intimation, retention limits, grievance redressal
A hospital treats an unconscious patient	Legitimate use: medical emergency	Security safeguards and breach intimation; ordinary duties once the emergency ends
Sharing records with police for an investigation	Exemption 17(1): offences	Your overall responsibility for the data and reasonable security (section 8(1) and 8(5))
A BPO in India handling US customers' data for a US client	Exemption 17(1): foreign contract	Overall responsibility and reasonable security; contract and foreign law still govern
Building a dataset for aggregate statistics	Exemption 17(2)(b): research	Nothing in the Act, if no individual decision follows and the Rules' standards are met
A recognised startup with a small user base	Possible 17(3) notification	Everything, unless a notification names your class; even then, only the listed duties fall away
Recovering dues from a loan defaulter	Exemption 17(1): default	Overall responsibility and reasonable security; disclosure rules in other laws

The access and correction rights are written around consent and expressly extend to the voluntary-sharing use. For the other legitimate uses the position is less clear; plan for requests and take advice before refusing one.

05 · Not a loophole

Why "legitimate use" will not carry a growth plan

The list is short, purpose-bound, and readable by the Board.

The tempting reading is that anything a customer typed into a form is fair game under the voluntary-sharing use. It is not. The use is tied to the purpose for which the data was given. Marketing to someone who gave a phone number for a delivery is a new purpose, and a new purpose needs consent.

Stretching the purpose. Using delivery data for promotions or profiling, then calling it voluntary sharing.
Employment as a catch-all. Monitoring staff beyond what employment or protecting the employer reasonably needs.
Calling analytics research. If the output targets a person, the research exemption is gone.
Assuming exemptions stop breach duties. Security duties survive every partial exemption. A breach is still your problem.
No written basis. If the record does not say which use or exemption you rely on, and why, a reviewer will assume consent was needed.

06 · Reviewer test

What a reviewer asks before accepting a no-consent basis

Five questions to answer in writing for each activity.

Which clause?. The exact use or exemption, by name, against each processing activity in your data map.
Which purpose?. The purpose the data was given for, and proof the current use stays inside it.
Any objection?. For voluntary sharing: how you capture and honour a person saying no.
What survives?. The duties that still apply, and the controls that meet them.
When does it end?. The point at which the basis lapses and the data is erased or moved to consent.

Sources: the Digital Personal Data Protection Act, 2023 (sections 4, 7, 8, 11, 12 and 17) and the Digital Personal Data Protection Rules, 2025 (rules 5 and 16, and the Second Schedule), as published by the Ministry of Electronics and Information Technology.

Questions about processing without consent

Is legitimate use the same as GDPR's legitimate interests?

No. The DPDP list is closed and has no balancing test.

The Act names nine specific uses. There is no open-ended ground you can argue into by weighing your interest against the person's. If the activity is not on the list, use consent.

Do we need consent to process employee data?

Often not, if it serves employment.

The employment use covers processing for employment purposes, protecting the employer from loss or liability, and benefits an employee asks for. Processing beyond that, such as marketing an employee's photo, needs consent.

Are startups exempt from the DPDP Act?

Not unless the government notifies their class.

Section 17(3) lets the government free notified classes, including startups, from certain duties. It is a power, not an automatic exemption. Until a notification covers you, the full set of duties applies.

If an exemption applies, can we ignore a breach?

No. Security duties survive.

The partial exemptions keep your overall responsibility for the data and the duty to take reasonable security safeguards. Only the total exemptions take processing outside the Act.

Write down the basis for every activity.

A DPDP readiness assessment tags each processing activity with its ground or exemption and lists the duties that remain. Counsel should confirm how the law applies to your contracts.

Get a DPDP readiness assessment Book a free consultation Back to DPDP services