# When you don't need consent: section 7 of the DPDP Act, ground by ground

> Section 4 of the DPDP Act allows processing on consent or for 'certain legitimate uses', which section 7 lists in nine clauses, with no general legitimate-interests ground. Private organisations will mostly rely on voluntary provision for a specified purpose (7(a)), legal disclosure duties and court orders (7(d), 7(e)), medical emergencies, epidemics and disasters (7(f)–(h)) and employment (7(i)); clauses 7(b) and 7(c) belong to the State, and marketing, analytics, AI training and prospecting fit none of them. Without consent, security, breach notice, accuracy, erasure, grievance and children's duties still apply, but access, correction and erasure rights attach only to consent and 7(a) (s. 11, 12).

Source: https://dpdp.commons.inc/dpdp-legitimate-uses · Updated 25 October 2026 · By the Commons Trust team (commons.inc)

Under the DPDP Act you may process personal data without consent only for one of the nine "certain legitimate uses" in section 7 (s. 4(1)(b)), and there is no general "legitimate interests" ground of the kind in Europe's GDPR. A private organisation will mostly rely on 7(a), data she gave you for a specified purpose; 7(d) and 7(e), legal disclosure duties and court orders; 7(f) to 7(h), emergencies, epidemics and disasters; and 7(i), employment, while 7(b) and 7(c) belong to the State. Without consent you still owe security, breach notice, accuracy, erasure, a grievance route and the children's duties, but the rights of access, correction and erasure attach only to consent and 7(a) (s. 11(1), 12(1)). These provisions apply from 13 May 2027.

Like the Act (s. 2(y)), we say "she" and "her" for every person.

**Jump to what you need:**

- **NGOs and relief teams:** [7(a)](#7-a-she-gave-it-to-you-for-a-specified-purpose), [7(f) to 7(h)](#7-f-medical-emergencies), [Cases](#cases-ngos-companies-government-partners-and-relief-work).
- **SaaS, e-commerce and B2B:** [7(a) or consent?](#7-a-or-consent-a-rule-for-sign-up-and-enrolment-forms), [Uses with no ground](#common-uses-with-no-section-7-ground).
- **Government partners and employers:** [7(b)](#7-b-state-benefits-for-the-state-only), [7(c)](#7-c-the-state-s-functions-under-law), [7(i)](#7-i-employment).
- **Legal and DPOs:** [What still applies](#what-still-applies-without-consent), [Rights by ground](#which-rights-attach-to-which-ground), [Where the law is unclear](#where-the-law-is-unclear-on-legitimate-uses).

## Section 7 at a glance

| Clause | One-line test | Who can use it | Access and correction rights (s. 11, 12)? |
|---|---|---|---|
| 7(a) | She gave you the data herself, for a purpose you specified, and has not said she objects | Any fiduciary | Yes |
| 7(b) | The State issues a prescribed benefit, service, certificate, licence or permit, and she consented to State processing before or the data is in a notified State database | The State and its instrumentalities | No |
| 7(c) | The State performs a function under law, or acts for sovereignty, integrity or security | The State and its instrumentalities | No |
| 7(d) | A law obliges you to disclose information to the State | Anyone under that obligation | No |
| 7(e) | You are complying with a judgment, decree or order, or a foreign contractual or civil judgment | Anyone bound by it | No |
| 7(f) | Someone's life, or immediate health, is under threat | Anyone responding | No |
| 7(g) | You are providing treatment or health services during an epidemic, outbreak or other public-health threat | Anyone taking those measures | No |
| 7(h) | You are keeping people safe or helping them during a disaster or breakdown of public order | Anyone taking those measures, while it lasts | No |
| 7(i) | Employment purposes, protecting the employer from loss or liability, or a benefit the employee asked for | Employers, chiefly for employees (reach beyond employees untested) | No |

The grievance right (s. 13) and the right to nominate (s. 14) are written for every Data Principal, whatever the ground; Rule 14(2) complicates this (see the unclear-law section).

## 7(a): she gave it to you for a specified purpose

The text: a fiduciary may process data "for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data" (s. 7(a)).

The Act gives two illustrations ([Gazette text, hosted by TRAI](https://www.trai.gov.in/sites/default/files/2024-09/DPDT_11082024.pdf)):

- A woman buying from a pharmacy gives her details and asks for a payment acknowledgement on her mobile. The pharmacy may use them to send the receipt.
- A woman messages a property broker asking for help finding a rented flat and shares her details for that. The broker may use them to find and tell her about flats. When she later says she no longer needs help, the broker "shall cease to process" her data.

In both, the purpose is the one she asked for, it is obvious to her, and it ends when she says so. Our position is to read 7(a) as narrowly as they suggest, applying each element of the text:

1. **Voluntarily provided.** She chose to hand the data over. Data collected about her from others, scraped or inferred is outside 7(a).
2. **To you.** Our view: the data must have been given to this fiduciary, so a funder, partner or group company that receives it from you cannot rely on her having given it to you, unless she provided it to both of you as joint fiduciaries for that purpose.
3. **For a specified purpose.** "Specified purpose" means "the purpose mentioned in the notice given by the Data Fiduciary" (s. 2(za)). Our view is that 7(a) works best, perhaps only, where you told her the purpose at collection.
4. **No objection.** Once she indicates she does not want the use, 7(a) ends for that use, as the broker illustration shows.

7(a) does not cover a new purpose (a delivery address reused for fundraising appeals), sharing with another fiduciary for its own purposes, marketing, research or AI training she was not told about, or a child's data without verifiable parental consent (s. 9(1), Rule 10). Processors acting for the same purpose, such as the SMS gateway sending the receipt, are part of your processing (s. 8(1)) and need a contract (s. 8(2)).

The Act treats 7(a) almost as a form of consent: ss. 11(1) and 12(1) speak of consent "including consent as referred to in clause (a) of section 7", so access, correction and erasure rights apply to it. [Our notice guide](/dpdp-consent-notice) has an illustrative information notice for a 7(a) use.

### 7(a) or consent? A rule for sign-up and enrolment forms

Ask of each field and each use: is it needed to give her what she asked for?

- **Yes:** 7(a), with a short information notice at the form. A shipping address and phone number at an e-commerce checkout; a work email and name to create a SaaS trial account and send login and service emails; a name and village to enrol her in the programme she came for.
- **No:** a separate consent, unticked, refusable without losing the service (s. 6(1)). Marketing emails and WhatsApp offers; recommendations built from her browsing; sales calls about a paid plan she did not ask about; sharing with partners; photos and stories.
- **A form that does both:** split it. One block of required fields under 7(a), and one consent per extra purpose.
- **A child user:** verified parental consent first, whichever ground you use (s. 9(1)).

If she asked for a demo or a call, following up on that request is 7(a). A nurture sequence after a free-trial sign-up is marketing, and needs consent.

## 7(b): State benefits, for the State only

Section 7(b) lets "the State and any of its instrumentalities" process data to provide or issue a prescribed subsidy, benefit, service, certificate, licence or permit where either she has previously consented to processing by the State for any such benefit (s. 7(b)(i)), or the data is in a database, register, book or other document maintained by the State and notified by the Central Government (s. 7(b)(ii)).

The Act's illustration: a pregnant woman enrols on a government app for a maternity benefit, consenting to processing for that. The government may process her data to determine her eligibility for other prescribed benefits.

Rule 5 explains "under law", "under policy" and "using public funds", and requires the Second Schedule standards: lawful processing, data limited to what is necessary, reasonable accuracy, retention only as long as needed, security, accountability, and an intimation to her with a contact person and how to exercise her rights (Second Schedule, (a)–(h)). State processing is also relieved of the erasure duty and right, and of the correction right where no decision affecting her is made (s. 17(4)).

A private NGO, foundation or vendor delivering a scheme does not rely on 7(b) in its own right. Our position: when you enrol or serve beneficiaries on a department's instructions and for its purpose, you act as its processor under the MoU, and anything of your own needs your own basis. [DPDP for NGOs](/dpdp-for-nonprofits) covers the MoU terms.

## 7(c): the State's functions under law

Section 7(c) covers processing "for the performance by the State or any of its instrumentalities of any function under any law", or in the interest of sovereignty and integrity or security of the State. "State" has its meaning in article 12 of the Constitution (s. 2(zb)), which courts have applied to some statutory bodies, public sector undertakings and government-run institutions; whether a particular body qualifies is a question for counsel.

The function must be conferred by law, so an executive scheme without a statute usually belongs under 7(b). A contractor performing part of the function acts as the State's processor.

## 7(d): a legal duty to disclose to the State

Section 7(d) covers "fulfilling any obligation under any law ... on any person to disclose any information to the State or any of its instrumentalities", subject to the disclosure rules in that other law.

Statutory returns are the common case: tax filings that name employees or donors, labour and social-security filings, regulatory returns. So are mandatory reports to the police, such as the duty under s. 19(1) of the Protection of Children from Sexual Offences Act, 2012 to report a known or apprehended offence against a child to the Special Juvenile Police Unit or the local police, failure being an offence (s. 21). For donation reporting, confirm the current provision of the income-tax law with your chartered accountant; the Income-tax Act, 2025 has applied from 1 April 2026.

The clause covers the disclosure. Where a law requires you to keep records, s. 8(7) excuses erasure while that law requires retention; storage continues on the original ground or, after a withdrawal, under s. 6(6). An official's request with no legal obligation behind it is outside 7(d), so ask for the provision before you disclose.

## 7(e): judgments, decrees and orders

Section 7(e) covers complying with "any judgment or decree or order issued under any law" in India, and with foreign judgments or orders on contractual or civil claims.

It reaches what the order requires, such as producing records to a court or deducting maintenance from salary under an attachment order. Building or defending your own case falls under a separate exemption: processing necessary for enforcing a legal right or claim is outside most of the Act, except the general responsibility for compliance (s. 8(1)) and security (s. 8(5)) (s. 17(1)(a)).

## 7(f): medical emergencies

Section 7(f) covers "responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual".

A helpline call from someone at risk of suicide, an accident at a field site, a beneficiary collapsing during a camp, a child's allergy shared with an ambulance crew: each qualifies. The threat can be to anyone, so you may process a bystander's or relative's details to get help.

Follow-up care, records kept afterwards and any reporting need another basis, usually 7(a) or consent, unless a law requires them, because the clause lasts only as long as the emergency.

## 7(g): epidemics and public-health threats

Section 7(g) covers "taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health".

Treatment camps, testing, contact follow-up and outreach during an outbreak are within it, whether run by government or by private and nonprofit providers. Our view: it does not cover routine health programmes in normal times. Anaemia or malnutrition is a public-health concern, but reading it as a "threat to public health" in the clause's sense would make 7(g) cover most health work, which the text does not suggest.

## 7(h): disasters and breakdowns of public order

Section 7(h) covers "taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order". The Act's Explanation gives "disaster" its meaning in section 2(d) of the Disaster Management Act, 2005. In summary, that is a catastrophe or grave occurrence, natural or man-made, causing substantial loss of life, suffering or damage, on a scale beyond the coping capacity of the affected community.

Relief registration, shelter lists, missing-person tracing, distribution records and lists shared with the district administration during a flood, cyclone, earthquake or riot all qualify, and anyone taking these measures can use the clause.

Rehabilitation, livelihoods and housing work months later need another basis, usually consent taken once people can give it freely, or 7(a) for services they ask for, because the clause applies only "during" the disaster. Plan the switch before the relief phase ends.

## 7(i): employment

Section 7(i) covers processing for employment purposes, for safeguarding the employer from loss or liability (such as corporate espionage or leaks of trade secrets), and for benefits an employee asks for: payroll, attendance, discipline, staff CCTV and salary advances, for example. Visitors and volunteers are not employees; our view is that 7(i) is written around employment, that whether its "safeguarding the employer" limb reaches visitors or volunteers is untested, and that visitor CCTV is an open question while volunteer records need consent or 7(a). Candidates, former employees, contract staff, monitoring and biometrics are covered in [Employee data under DPDP](/dpdp-employee-data).

## Common uses with no section 7 ground

Much ordinary business processing fits no clause of section 7. GDPR teams used to "legitimate interests" will find the gap largest here; [DPDP and GDPR compared](/dpdp-vs-gdpr) explains why.

| Use | Basis under the DPDP Act |
|---|---|
| Direct marketing by email, SMS or WhatsApp, including to existing customers and donors | Consent. A receipt or service message is 7(a); an appeal or offer is not. |
| Product analytics and telemetry | Consent for analytics, unless it is needed to deliver what she asked for (7(a)) or is a log the Rules require (Rule 6(1)(c), (e), Rule 8(3)). Truly anonymised data is not personal data (s. 2(t)). |
| Training AI models on customer or beneficiary data | Consent, or the research and statistics exemption where no decision about an individual follows and the Second Schedule standards are met (s. 17(2)(b), Rule 16). Otherwise none. |
| B2B prospecting from bought lists or scraped profiles | Consent. Data she herself made public is outside the Act (s. 3(c)(ii)); our view is to use it only in the context she published it. A bought list has no ground. |
| Credit scoring and underwriting | Consent, alongside sector rules. Ascertaining the assets and liabilities of a person who has defaulted on a loan or advance from a financial institution is exempt from most of the Act, subject to the disclosure rules in other law (s. 17(1)(f)). |
| Visitor CCTV | An open question. The Act has no implied consent: walking past a sign is unlikely to be the "clear affirmative action" s. 6(1) needs. Our view: give a clear notice at the entrance, keep footage briefly, and take advice on the basis. Confidence: low. |
| Research and evaluation | The research exemption if its conditions are met (s. 17(2)(b)); otherwise consent. |
| Fraud and offence prevention | Exempt from most duties under s. 17(1)(c), with compliance responsibility and security remaining. |

## What still applies without consent

| Duty | Under a legitimate use? |
|---|---|
| Lawful purpose (s. 4(1)) | Yes |
| Notice under s. 5 and Rule 3 | Strictly, only with a consent request. The State gives an intimation for 7(b) (Second Schedule, (g)). We recommend an information notice for 7(a) and a published purpose list for the rest. |
| Consent rules and withdrawal (s. 6) | No. For 7(a), an objection ends the use. |
| Processor contracts and responsibility for processors (s. 8(1), 8(2)) | Yes |
| Accuracy where data is used to decide about her or shared with another fiduciary (s. 8(3)) | Yes |
| Reasonable security safeguards (s. 8(5), Rule 6) | Yes |
| Breach intimation to the Board and each affected person (s. 8(6), Rule 7) | Yes |
| Erasure once the purpose is no longer served, unless law requires retention (s. 8(7)) | Yes, except for the State (s. 17(4)) |
| One-year minimum retention of data and logs for the Seventh Schedule purposes (Rule 8(3)) | Yes |
| Published contact person (s. 8(9), Rule 9) and grievance mechanism (s. 8(10)) | Yes |
| Children's duties (s. 9) | Yes, including verifiable parental consent unless a Fourth Schedule row applies; see [our children's guide](/dpdp-childrens-data) |
| Transfers abroad (s. 16, Rule 15) | Yes |

## Which rights attach to which ground

| Right | Consent | 7(a) | Other section 7 grounds |
|---|---|---|---|
| Withdraw consent (s. 6(4)) | Yes | Not as such; an objection ends the use | No |
| Access: summary of data, processing and recipients (s. 11) | Yes | Yes | No |
| Correction, completion, updating (s. 12(1), (2)) | Yes | Yes | No |
| Erasure on request (s. 12(3)) | Yes, unless retention is necessary for the purpose or a law | Yes, on the same terms | No |
| Grievance redressal (s. 13) | Yes | Yes | Yes |
| Nomination (s. 14) | Yes | Yes | Yes, on the Act's text |

Losing the access right does not license secrecy. Section 8(3) still requires accurate data where it is used to decide about her, and a grievance about wrong data must be answered (s. 13). The State's 7(b) intimation tells her how to exercise "her rights under the Act" (Second Schedule, (g)(ii)), which we read as the grievance and nomination rights.

## Cases: NGOs, companies, government partners and relief work

Our reading of the likely basis. Each depends on the facts, and where consent appears it must meet s. 6(1).

| Situation | Likely basis | Notes |
|---|---|---|
| A woman walks into a legal-aid clinic and describes her case | 7(a), and s. 17(1)(a) for enforcing her claim | Give a short information notice. Do not reuse her story without consent. |
| A caller to a women's helpline is in immediate danger | 7(f), or 7(h) if public order has broken down | Share only what is needed to get help. Later case work needs another basis. |
| Enrolling families in an NGO's own nutrition programme | 7(a) for the service she asked for; consent for extras | Children need verified parental consent. |
| Enrolling families in a state scheme under a department MoU | The State's 7(b); the NGO is its processor | Add no purposes of your own. |
| Reporting beneficiary numbers to a CSR funder | Counts are not personal data; named lists need consent naming the funder | See [DPDP for CSR foundations](/dpdp-for-csr-foundations). |
| Sending a donor her donation receipt | 7(a), on the pharmacy illustration | Appeals and newsletters need consent. |
| Reporting suspected sexual abuse of a child to the police | 7(d) | The reporting law governs what is disclosed. |
| Flood relief registration and distribution lists | 7(h), during the disaster | Plan consent or 7(a) for rehabilitation. |
| A health camp during a declared outbreak | 7(g) | Routine camps in normal times need consent or 7(a). |
| A user signs up for a SaaS trial with her work email | 7(a) for the account and service emails | Nurture and upsell sequences need consent. |
| A SaaS product's in-app analytics | Consent, unless needed to deliver the service or a log the Rules require | See the table above. |
| An e-commerce shopper's address and phone for delivery | 7(a) | Recommendations from browsing history need consent. |
| A business card handed over at a conference | 7(a) for the follow-up she asked for | Adding her to a mailing list needs consent. |
| A sales team emailing contacts from a bought list | No ground | Get consent through her own sign-up, or do not send. |
| Producing employee records under a court order | 7(e) | Disclose only what the order requires. |

This illustration is a composite, not a client story. A cyclone hits a coastal district in October 2027. A relief NGO registers 4,000 households at shelters on tablets, shares lists with the district control room and traces missing relatives, all under 7(h). Three weeks later the shelters close and the NGO starts a housing programme. Its field teams play a notice in Odia, explain the programme, and take consent for the new purpose and for any photographs. Households who decline still receive relief kits. Shelter lists not needed for housing are erased on a date set at the start, after the Rule 8(3) one-year minimum, and the erasure is logged.

## A legitimate-use register

For every activity run without consent, record the clause and why it applies: one row per purpose, owned by the business owner of the data.

*Illustrative register.*

| Purpose | Data | Clause | Why it applies | Decided by, on | Told her how | Kept for | Rights offered | Reviewed on |
|---|---|---|---|---|---|---|---|---|
| Donation receipts | Name, mobile, email, amount, donor ID | 7(a) | She gave details to receive a receipt; no other use | Head of Fundraising, 3 Mar 2027 | Line on donation form | Per tax law | Access, correction, erasure, grievance | 3 Sep 2027 |
| Payroll | Name, bank, tax ID, salary | 7(i); 7(d) for filings | Employment purpose; statutory returns | HR Head, 10 Feb 2027 | Employee privacy notice | Per labour and tax law | Grievance, nomination | 10 Aug 2027 |
| Shelter registration | Household names, ages, phone, location | 7(h) | Assistance during the cyclone, while relief lasts | Relief Lead, on activation | Spoken notice at registration | End of relief phase, then Rule 8(3) floor | Grievance | At close of relief |

A row whose "Why it applies" column cannot be filled in one sentence probably belongs under consent.

## Where the law is unclear on legitimate uses

**Does 7(a) need a notice?** In practice, yes. *Why:* 7(a) turns on a "specified purpose", defined as the purpose mentioned in the notice the fiduciary gives (s. 2(za)), so without some notice there may be no specified purpose. *Would change if:* the Board accepts purposes obvious from context. *Confidence:* medium.

**Can 7(a) cover required fields on a form?** Only where the field is needed for the service she is asking for. *Why:* she still chose to apply and the purpose is the service, but a field that serves your purposes rather than hers is not "voluntarily provided" in any useful sense. *Would change if:* the Board reads "voluntarily" as excluding any required field. *Confidence:* medium.

**When does "during any disaster" end?** When the emergency response ends, which we mark by the closing of shelters or the end of the official relief phase. *Why:* the clause covers safety and assistance "during" the disaster, and rehabilitation is a separate activity. *Would change if:* the Board accepts a longer recovery period. *Confidence:* medium.

**Does 7(g) cover routine public-health programmes?** No. *Why:* "any other threat to public health" sits with epidemics and outbreaks, which are acute. *Would change if:* the government or the Board treats chronic conditions as threats under 7(g). *Confidence:* medium.

**Can people make rights requests where the ground is not consent?** Grievance and nomination, yes; access and correction, no. *Why:* ss. 13 and 14 cover every Data Principal, while ss. 11 and 12 are tied to consent and 7(a). Rule 14(2) describes requests to a fiduciary "to whom she has previously given consent", which a narrow reading would extend to all rights. *Would change if:* the Board reads Rule 14(2) as limiting ss. 13 and 14. *Confidence:* medium.

**Does s. 6(10)'s burden of proof apply to legitimate uses?** Not in terms; it covers consent. *Why:* the text is limited to consent, though a fiduciary that cannot show why a ground applied will struggle in an inquiry. *Would change if:* the Board applies a similar burden by analogy. *Confidence:* high on the text.

## Putting it to work before 13 May 2027

1. **List purposes.** From your data map, list every purpose for which you process personal data. [DPDP deadlines](/dpdp-timeline) has the full calendar.
2. **Assign one ground per purpose.** Consent or a named clause of section 7, using the tests above. Where two seem to fit, choose the narrower and record why.
3. **Move the no-ground uses to consent:** marketing, non-essential analytics, prospecting, AI training.
4. **Fill the register** and have the owner of each purpose sign it off.
5. **Fix the forms and notices.** Split sign-up and enrolment forms into 7(a) fields and separate consents; add an information notice for 7(a) uses and a purpose list to your privacy notice.
6. **Set retention for each row,** including when a 7(f) or 7(h) use ends.
7. **Route rights requests by ground,** so the team knows when access and correction apply, and review the register every six months.

For data you already hold, [the data you already hold](/dpdp-existing-data) explains which legacy data sets a legitimate use can cover and which need fresh consent or erasure.

**How we wrote this guide.** We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), checking the illustrations to s. 5(1), 7(a) and 7(b) and the Explanation to s. 7(h) against the Gazette text, and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)). The summary of the Disaster Management Act definition is ours; read section 2(d) of that Act before relying on it. Events after November 2025 were last checked on 25 October 2026. Statements marked as our view, position or recommendation are judgement, not law. This guide explains the law; it is not legal advice for your situation.
{: .note }

## Questions people ask

### Can a group company rely on the 7(a) ground we have?

No. Section 7(a) covers data she gave to the Data Fiduciary for a specified purpose, and each company in a group is a separate fiduciary; the Act has no group exemption. A sister company that wants to use the data for its own purposes needs its own basis, usually her consent. The exception is where she provided the data to both companies as joint fiduciaries for that purpose, for example through a co-branded sign-up that named both and the purpose each would serve.

### Does 7(a) survive a merger or acquisition?

Processing necessary for a court- or tribunal-approved scheme of merger, amalgamation or demerger is exempt from most of the Act (s. 17(1)(e)). Our view: where the acquirer succeeds to the business by amalgamation, it can continue under 7(a) only for the purpose she was told about; on a purchase of data or assets without succession, treat it as a new fiduciary needing its own basis. A new purpose, such as cross-selling the acquirer's products, needs her consent. Our recommendation is to tell people who now holds their data and how to object, even though the Act does not expressly require it.

### Is KYC a section 7(d) use or a retention duty under s. 8(7)?

It touches three provisions. The Act's own illustration to s. 5(1) describes a bank customer who opts for video-based KYC to meet legal requirements, with the bank giving a notice describing the data and purpose: it treats collection as a consent request with notice. Keeping KYC records for the period the anti-money-laundering law requires falls under the retention exception in s. 8(7). Reporting to the authorities under that law is a disclosure obligation within s. 7(d). Confirm the current periods with your compliance team.

### What ground covers security logs and fraud checks, if there is no legitimate interests?

The Rules themselves require logs: access logs and monitoring under Rule 6(1)(c), a year of logs under Rule 6(1)(e), and a one-year minimum retention of data and logs for the Seventh Schedule purposes under Rule 8(3). Our view is that processing which the Rules require is lawful without a separate consent. Processing in the interest of preventing, detecting or investigating offences is exempt from most of the Act (s. 17(1)(c)), though responsibility for compliance (s. 8(1)) and security (s. 8(5)) remain. Fraud scoring for marketing or credit decisions needs its own basis.

### Do we have to tell people which legitimate use we rely on?

The Act requires a notice with a consent request (s. 5(1)), a notice for consents given before the provisions commenced (s. 5(2)), and, for the State's 7(b) processing, an intimation under the Second Schedule. It does not require a published list of grounds. Our recommendation is to publish one anyway, purpose by purpose, in your privacy notice, and to give a short information notice at collection for anything under 7(a). The record helps if the Board asks.

### What happens if we rely on a legitimate use that does not apply?

The processing then has no ground under section 4, which falls under the residual penalty item of up to ₹50 crore (Schedule, item 7). A penalty needs an inquiry finding the breach significant and a hearing (s. 33(1)), and the amount depends on factors including gravity, duration and how quickly you put it right (s. 33(2)). A written assessment made at the time, showing why you believed the ground applied, will not make a wrong reading right, but it shows good faith and speeds remediation.

## About Commons Trust

Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. Contact: hello@commons.inc · https://dpdp.commons.inc/#start