Lesson 4.5: The legitimate uses in Section 7
Nine situations where you can process without consent. Learn them precisely. This DPDPA 2023 course page explains the legitimate uses in section 7 in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about the legitimate uses in section 7
- List the legitimate uses
- Apply each to a real case
- Know their limits
The list (the legitimate uses in section 7)
You may process personal data without consent only for: voluntary provision for a specified purpose where the person did not object; State subsidies and benefits; State functions in the interest of sovereignty and security; legal obligations and disclosures; judgments and orders; medical emergencies; epidemics and public health threats; disasters and public order; and employment purposes.
Click each use
Select a numbered box to read more.
Limits to remember (the legitimate uses in section 7)
| Use | Limit |
|---|---|
| Voluntary provision | Only the stated purpose |
| Employment | Only for employment-related purposes |
| Legal obligation | Only what the law requires |
Worked example
A hospital treats an unconscious accident victim and records details. That is a medical emergency use, so consent is not needed at that time.
Activity (5 minutes) (the legitimate uses in section 7)
Mark which of your purposes fall under a legitimate use and which do not.
Check your understanding of the legitimate uses in section 7
Q1. Marketing emails fall under:
Q2. Payroll falls under:
Q3. A medical emergency use needs:
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.