A founder in Indore rang me up a few weeks ago, sounding half embarrassed. One of his couriers had fainted on a delivery run. His ops manager wouldn’t call the family because, in his words, “the DPDP thing says we need permission first.”
He was wrong, and I’m glad he asked. Legitimate use under DPDP Act exists for exactly this kind of mess. But I’ve also watched people read about it once and start using it for everything. That part worries me more.
What Legitimate Use Under DPDP Act Actually Is
Short version: the Act normally wants consent. Section 7 carves out a handful of situations where it doesn’t. If your situation isn’t one of them, you ask for consent. No negotiation.
Here’s the list, trimmed down to what matters for ordinary companies.
A person hands you their data on their own and doesn’t object. Say they share a number for delivery updates. You can use it for delivery updates. Your Diwali offer? Different story.
A medical emergency. That’s the courier.
A disaster, an epidemic, a threat to public order. Rare, thankfully.
A law or a court order that forces you to process the data.
Government subsidies, licences, benefits. Mostly relevant if you work with the State.
Employment. Honestly this is the one I get asked about most. You can process employee data for work purposes without a fresh consent form each time. I went into more detail in our post on employee data privacy under the DPDP Act.
That’s it. Six situations. If you were hoping for a seventh that covers “we need it for business,” sorry.
The GDPR Trap Most Teams Fall Into
This is the mistake I see weekly. Someone on the team has worked with GDPR, which has a very wide “legitimate interest” ground. So they assume India has the same thing. It doesn’t.
Wanting sharper ad targeting is not a legitimate use here. Neither is “improving the product” or “it’s in our interest.” I covered the whole gap in DPDP Act vs GDPR, and it’s worth ten minutes if your policies were copied from a European template.
Purpose creep is the quieter version of the same problem. A customer gives you an email for an invoice. Next month marketing adds it to the newsletter. Nobody told the customer. That’s a new purpose, and the invoice never covered it.
Marketing, by the way, never counts as legitimate use. I’ll say it a third time because it keeps coming up. Never.
How I Check Before Using Legitimate Use Under DPDP Act
Before I’d tell any client to rely on this, I make them do a small exercise. Write down the activity. Find the clause. If there’s no clause, stop. It’s consent, full stop.
If there is a clause, write two lines on why it fits. Collect only what you need. Stop when the purpose is done. And put the note somewhere with a date on it. I know, boring. But if the Data Protection Board ever asks, that dated note is your whole defence.
One more thing. Skipping consent doesn’t mean skipping honesty. Your notice should still say what you collect and why. Our privacy policy drafting guide walks through it.
Don’t Take My Word for It
Go read the actual Act. It’s on the MeitY website, along with the rules. They get updated, so check the latest version before you build a process around anything I’ve said here.
If You’re Still Unsure
Most businesses will use this exception rarely. Clean consent is safer, and usually less work than people fear. But when you do rely on legitimate use under DPDP Act, get it right the first time. A wrong call turns a routine task into a headache.
Not sure which of your data activities need consent and which don’t? Book a free consultation. We’ll go through them with you, in plain language.