Data protection · Provision

Section 7, DPDP Act 2023 — Legitimate Uses, Including Employment

Section 7, Digital Personal Data Protection Act, 2023

A closed list of uses that need no consent, one of which covers processing for the purposes of employment.

Quick Statutory Answer

Section 7 of the DPDP Act 2023 lists the legitimate uses for which personal data may be processed without consent. Clause (i) permits an employer to process employee data for the purposes of employment, and to safeguard the employer from loss or liability, including the prevention of corporate espionage and the maintenance of confidentiality of trade secrets, intellectual property and classified information, or to provide a service or benefit the employee has sought.

Check your compliance exposure — free All provisions

What the section does

  • Section 7 sets out the uses for which a Data Fiduciary may process personal data without obtaining consent. The list is exhaustive: a use that is not on it is not a legitimate use.
  • The first covers data the Data Principal has voluntarily provided for a specified purpose, where she has not indicated that she does not consent to its use for that purpose.
  • Clause (i) covers processing for the purposes of employment, or to safeguard the employer from loss or liability — prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property and classified information, or providing a service or benefit sought by a Data Principal who is an employee.
  • Other clauses cover State functions and the issue of subsidies, benefits and licences, compliance with a legal obligation to disclose to the State, a court order, a medical emergency, an epidemic or threat to public health, and a disaster or breakdown of public order.

Section 7 DPDP Act — Legitimate Uses Requiring No Consent

Section 7 DPDP Act — Legitimate Uses Requiring No Consent
Legitimate Use Typical Situation Consent Needed
Voluntarily provided for a specified purpose Customer hands over a phone number to receive an order update No, for that purpose
Purposes of employment Payroll, attendance records, performance files, access control No
Safeguarding employer from loss or liability Protecting trade secrets, intellectual property, classified information No
Service or benefit sought by an employee Insurance enrolment, reimbursement, loan letter the employee asked for No
Compliance with a legal obligation to disclose to the State Statutory filing or a lawful demand for information No
Medical emergency, epidemic, disaster or breakdown of public order Threat to life or to public health No
Marketing to staff, or reuse for an unrelated purpose Sending employees offers unconnected with employment Yes — no clause reaches it

Employment processing

no consent required. The relief is real but bounded. It reaches employment purposes and protection of the employer from loss or liability, not everything an employer might wish to do with staff data.

Where people go wrong

  • Reading the employment clause as covering everything done to employee data. It reaches employment purposes and protection from loss or liability, not any processing the employer finds convenient.
  • Relying on the voluntary-provision clause after the person has objected. It applies only where the Data Principal has not indicated that she does not consent to that use.
  • Treating a legitimate use as removing the rest of the Act. The duties under section 8 — security, accuracy, erasure, breach notification, a grievance contact — continue to apply.
  • Stretching a clause by analogy. The list is closed, so a use that merely resembles one on it is not on it.

Common questions

Does an employer need consent to process employee data under the DPDP Act?

Not for the purposes of employment. Section 7(i) makes that a legitimate use, along with safeguarding the employer from loss or liability and providing a service or benefit the employee has sought. Processing outside those purposes still needs a ground.

Is there a legitimate use for marketing?

No. Section 7 does not list marketing, and the list is exhaustive. Marketing to a person requires consent obtained under section 6.

Do the duties in section 8 still apply to a legitimate use?

Yes. Section 7 supplies a ground to process without consent. It does not switch off the obligations of a Data Fiduciary, which attach to the processing however it is grounded.

Act on this

  • Section 4 — the two grounds
  • Section 8 — the duties that still apply
  • Employment agreement template

About this summary

A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.