Data protection · Provision
A closed list of uses that need no consent, one of which covers processing for the purposes of employment. (Section 7, Digital Personal Data Protection Act, 2023.) Comes into force on 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Section 7 of the DPDP Act 2023 lists the legitimate uses for which personal data may be processed without consent. Clause (i) permits an employer to process employee data for the purposes of employment, and to safeguard the employer from loss or liability, including the prevention of corporate espionage and the maintenance of confidentiality of trade secrets, intellectual property and classified information, or to provide a service or benefit the employee has sought.
7. Certain legitimate uses.— A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely:— (a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data. Illustrations. (I) X, an individual, makes a purchase at Y, a pharmacy. She voluntarily provides Y her personal data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal data of X for the purpose of sending the receipt. (II) X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal data for this purpose. Y may process her personal data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal data of X; (b) for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, where— (i) she has previously consented to the processing of her personal data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit; or (ii) such personal data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document which is maintained by the State or any of its instrumentalities and is notified by the Central Government, subject to standards followed for processing being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal data. Illustration. X, a pregnant woman, enrols herself on an app or website to avail of government's maternity benefits programme, while consenting to provide her personal data for the purpose of availing of such benefits. Government may process the personal data of X processing to determine her eligibility to receive any other prescribed benefit from the government; (c) for the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State; (d) for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force; (e) for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India; (f) for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual; (g) for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health; (h) for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order. Explanation.— For the purposes of this clause, the expression "disaster" shall have the same meaning as assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005 (53 of 2005); or (i) for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee.
| Legitimate Use | Typical Situation | Consent Needed |
|---|---|---|
| Voluntarily provided for a specified purpose | Customer hands over a phone number to receive an order update | No, for that purpose |
| Purposes of employment | Payroll, attendance records, performance files, access control | No |
| Safeguarding employer from loss or liability | Protecting trade secrets, intellectual property, classified information | No |
| Service or benefit sought by an employee | Insurance enrolment, reimbursement, loan letter the employee asked for | No |
| Compliance with a legal obligation to disclose to the State | Statutory filing or a lawful demand for information | No |
| Medical emergency, epidemic, disaster or breakdown of public order | Threat to life or to public health | No |
| Marketing to staff, or reuse for an unrelated purpose | Sending employees offers unconnected with employment | Yes — no clause reaches it |
no consent required. The relief is real but bounded. It reaches employment purposes and protection of the employer from loss or liability, not everything an employer might wish to do with staff data.
Not for the purposes of employment. Section 7(i) makes that a legitimate use, along with safeguarding the employer from loss or liability and providing a service or benefit the employee has sought. Processing outside those purposes still needs a ground.
No. Section 7 does not list marketing, and the list is exhaustive. Marketing to a person requires consent obtained under section 6.
Yes. Section 7 supplies a ground to process without consent. It does not switch off the obligations of a Data Fiduciary, which attach to the processing however it is grounded.
On 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34. Section 7 is in the last group.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.