Employment
Section 7(i) of the Digital Personal Data Protection Act lets a data fiduciary handle employee information for genuine employment purposes or to protect the business from loss, removing the need for consent but still obliging the employer to meet security, accuracy and breach‑notification duties, so the cost is limited relief, not a free‑pass for all staff data use.
Check your DPDP readiness — free More on the blogThe DPDP Act creates a closed list of situations where a data fiduciary may process personal data without first obtaining the data principal’s consent. Section 7 spells out that list and makes it exhaustive, meaning any purpose not expressly mentioned does not qualify as a legitimate use. For businesses, this means the law does not allow a blanket exemption; each processing activity must be matched against the specific clauses in the section.
Clause (i) of Section 7 specifically permits processing for the purposes of employment. This covers activities that are directly related to the employee’s job, such as payroll, performance appraisal, attendance tracking and compliance with workplace policies. It also includes actions taken to safeguard the employer from loss or liability, for example protecting trade secrets or preventing corporate espionage. The key point is that the processing must be tied to an employment‑related objective, not merely any convenience the employer might find. The relief provided by this clause is real but bounded. While consent is not required for the core employment functions listed, the employer cannot use the same justification to process data for unrelated purposes such as marketing, profiling for promotions or sharing information with third parties for commercial gain. Those activities fall outside the legitimate use definition and would still need a separate legal ground, typically the consent of the employee under Section 6.
Another part of Section 7 deals with data that the principal has voluntarily provided for a specified purpose, provided the individual has not indicated an objection. This means if an employee supplies information for a particular task and later objects to its further use, the employer must respect that objection. The exemption only applies while the employee’s silence or affirmative consent remains unchallenged, so businesses should maintain clear records of any objections to avoid unlawful processing.
Even when processing falls within a legitimate use, the data fiduciary must still comply with the duties set out in Section 8. These include implementing appropriate security safeguards, ensuring data accuracy, providing mechanisms for erasure where required, notifying authorities of breaches and maintaining a grievance redressal contact. The legitimate use clause does not switch off these obligations; it merely supplies a ground to proceed without consent. For small businesses, the cost of compliance therefore includes not only the technical measures to protect data but also the administrative effort to track consent status, document legitimate uses and respond to employee grievances. Ignoring these duties can lead to regulatory penalties, reputational damage and potential civil liability, which often outweigh any short‑term convenience gained from unchecked data use. A common mistake is to read the employment clause as a blanket permission for any employee data handling. The law limits the exemption to genuine employment purposes and protection against loss or liability. Anything that merely resembles an employment activity but does not directly serve that purpose is not covered, and proceeding without consent can attract enforcement action. Similarly, some organisations rely on the voluntary‑provision clause after an employee has explicitly objected. The exemption disappears the moment the data principal signals that she does not consent to further use. Companies must therefore have a process to capture and honour such objections promptly, updating their processing logs accordingly. Finally, stretching a clause by analogy is a pitfall. The list in Section 7 is closed; a purpose that only loosely aligns with one of the enumerated uses does not become legitimate by inference. When in doubt, seek an alternative ground such as explicit consent or a statutory requirement, and document the rationale for the chosen basis.
No. Payroll processing falls within the employment purpose covered by Section 7(i), so consent is not required. However, the employer must still meet security, accuracy and breach‑notification duties under Section 8.
No. Internal marketing is not listed in Section 7, so it is not a legitimate use. The employer would need explicit consent from the employee under Section 6 to process data for that purpose.
The exemption for voluntarily provided data ends once the employee indicates she does not consent. The employer must stop processing that data for the specified purpose and must either obtain fresh consent or find another legal ground.
Yes. Section 7 only supplies a ground to process without consent. All obligations in Section 8 – security, accuracy, erasure, breach notification and grievance handling – continue to apply to the processing.
Published 25 September 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.