Legitimate Uses

Section 7 of the Digital Personal Data Protection Act 2023 enumerates the 'legitimate uses' for which personal data may be processed without obtaining the Data Principal's consent under Section 6. The list is narrower than GDPR's six Article 6 lawful bases — there is no DPDP equivalent of GDPR's 'legitimate interests' balancing test. The specified legitimate uses include: data the Principal has voluntarily provided for a specified purpose and has not objected to its use; processing by the State for subsidy, benefit, service, certificate, licence or permit; processing for compliance with a judgment, decree or order of a court or tribunal; processing in response to a medical emergency involving a threat to life or immediate threat to health; processing for taking measures during an epidemic, outbreak of disease or any threat to public health; processing in response to a disaster or breakdown of public order; and processing in connection with employment of the Data Principal.

Section 7 processing still carries the baseline Section 8 duties — purpose limitation, data minimisation, security safeguards, breach notification, retention limits, Data Principal rights. The main practical gain is that no fresh consent is required for the specified purpose. Section 7 commences on 13 May 2027 alongside the other core duties. For a privacy programme, the practical discipline is to label each processing activity in the RoPA as consent-based (Section 6), legitimate-use (specific Section 7 clause with facts in support), or exempt (specific Section 17 ground) — not as a mixed basis.