Section 7 — Certain legitimate uses

What this section requires

Section 7 lists the situations where a Data Fiduciary may process personal data without seeking consent — nine "certain legitimate uses" in total: data the Data Principal voluntarily provided for a specific purpose and hasn't objected to; State-provided subsidies, benefits, services, certificates, licences or permits (on prior consent or from a notified government database); performance of a State function under law, or in the interest of India's sovereignty, integrity or security; compliance with a legal disclosure obligation; compliance with a court judgment, decree or order; responding to a medical emergency; providing medical treatment during an epidemic or public-health threat; ensuring safety during a disaster or breakdown of public order; and processing for employment purposes or to protect the employer from loss or liability.

Each ground is narrow and purpose-bound — it justifies processing only to the extent that specific use requires, not a general licence to skip consent.

Who it applies to

Any Data Fiduciary processing personal data on a ground other than consent — Section 7 is the complete list; there is no residual "legitimate interest" ground beyond what it names.

Checklist

• Match every non-consent processing activity to one specific clause of Section 7 — "it feels reasonable" is not itself a ground.
• For voluntarily-provided data (clause (a)), stop processing the moment the Data Principal indicates she no longer consents to that use.
• For State-benefit processing (clause (b)), confirm the standards followed match the Central Government's governance policy or applicable law.
• For employment-related processing (clause (i)), keep the processing scoped to the employment relationship or the specific loss/liability it protects against — not general employee monitoring.

Penalty exposure

No Schedule item names Section 7 directly. Processing that doesn't genuinely fit any Section 7 clause has no lawful ground at all under Section 4, which the Schedule's residual item 7 catches — up to ₹50 crore.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).