--- title: "Section 7: Certain legitimate uses" url: https://dpdp.myndsolution.com/wiki/act/section-7-certain-legitimate-uses/ description: "Section 7 of the Digital Personal Data Protection Act, 2023 (Certain legitimate uses). Official text verbatim, comes into force on 13 may 2027, with…" kind: act-section updated: 2026-09-09 official_source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf text_type: official-text-plus-interpretation publisher: MYND Integrated Solutions license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions. disclaimer: Not legal advice. Official text prevails over any interpretation. html_version: https://dpdp.myndsolution.com/wiki/act/section-7-certain-legitimate-uses/ --- # Section 7: Certain legitimate uses *The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Chapter II: OBLIGATIONS OF DATA FIDUCIARY. Comes into force on 13 May 2027.* ## Official text A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely:— - **(a)** for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data. - **(b)** for the State and any of its instrumentalities to provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed, where–– - **(i)** she has previously consented to the processing of her personal data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit; or - **(ii)** such personal data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document which is maintained by the State or any of its instrumentalities and is notified by the Central Government, subject to standards followed for processing being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal data. - **(c)** for the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State; - **(d)** for fulfilling any obligation under any law for the time being in force in India on any person to disclose any information to the State or any of its instrumentalities, subject to such processing being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force; - **(e)** for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India; - **(f)** for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual; - **(g)** for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health; - **(h)** for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order. **Explanation.—** For the purposes of this clause, the expression “disaster” shall have the same meaning as assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005; or - **(i)** for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee. > **Illustrations.** (I) X, an individual, makes a purchase at Y, a pharmacy. She voluntarily provides Y her personal data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal data of X for the purpose of sending the receipt. > **Illustrations.** (II) X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal data for this purpose. Y may process her personal data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal data of X; > **Illustration.** X. a pregnant woman, enrols herself on an app or website to avail of government’s maternity benefits programme, while consenting to provide her personal data for the purpose of availing of such benefits. Government may process the personal data of X processing to determine her eligibility to receive any other prescribed benefit from the government; ## Rules made under this section - [Rule 5: Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalities](https://dpdp.myndsolution.com/wiki/rules/rule-5-processing-of-personal-data-for-provision-or-issue-of/) ## Interpretation in plain English (not legal advice) > This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation. Section 7 lists specific situations, called certain legitimate uses, where a Data Fiduciary (the entity determining the purpose of processing) can process a Data Principal's (the individual's) personal data without needing to get formal consent. One major use is when an individual voluntarily provides their data for a specific purpose and does not object to its use for that purpose. For example, if a person gives their phone number to a pharmacy to get a receipt, the pharmacy can use it to send that receipt. The State and its instrumentalities have broad permissions under this section. They can process personal data to provide subsidies, benefits, services, certificates, licenses, or permits if the individual previously consented to processing for any such benefit, or if the data is in a government database notified by the Central Government. The State can also process data to perform its legal functions, protect national security, or maintain the sovereignty and integrity of India. Other legitimate uses cover emergencies, legal obligations, and employment. Data can be processed to respond to medical emergencies, epidemics, disasters, or breakdowns of public order. It can also be processed to comply with court judgments or legal obligations to disclose information to the State. Finally, employers can process an employee's data for employment purposes, to provide benefits the employee asks for, or to protect the employer from loss or liability, such as preventing corporate espionage or protecting trade secrets. ### Key points - A Data Fiduciary may process personal data if the Data Principal voluntarily provides it for a specified purpose and does not indicate a lack of consent (a). - The State may process data for prescribed subsidies, benefits, or services if the individual previously consented to any government benefit or if the data is in a notified government database (b). - Processing is allowed for State functions under law, national security, or the sovereignty and integrity of India (c). - Data may be processed to comply with Indian court orders, or foreign judgments related to civil or contractual claims (e). - Processing is permitted for medical emergencies, epidemics, disasters, or breakdowns of public order (f, g, h). - Employers may process employee data for employment purposes, providing requested benefits, or safeguarding against corporate espionage and loss (i). ### Common misreadings - One might assume that voluntarily providing data allows the Data Fiduciary to use it for anything, but the text restricts it to the specified purpose for which it was provided. - One might think the State needs fresh consent for every new subsidy, but the text allows processing if the individual previously consented to any subsidy or benefit. *Interpretation prepared 2026-09-09 from the official text only; the official text prevails.* --- Cite as: Digital Personal Data Protection Act, 2023, s. 7. Official source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf