Legitimate Uses Under the DPDP Act, 2023

Last updated: 6 August 2026

Consent is the general basis for processing personal data under the Digital Personal Data Protection Act, 2023. However, the Act also recognises certain “legitimate uses” for which an organisation (a “Data Fiduciary”) may process personal data without obtaining separate consent. These are specific and limited, and each is subject to the conditions set out in the Act.

The legitimate uses recognised by the Act

Voluntary provision — where the individual has voluntarily provided their personal data for a specified purpose and has not indicated that they object to its use for that purpose.
State benefits and services — where the State or its instrumentalities provide a subsidy, benefit, service, certificate, licence, or permit, subject to the conditions in the Act.
Functions of the State — performance of a function under any law, or in the interests of the sovereignty and integrity of India or the security of the State.
Legal obligations to disclose — to comply with an obligation under any law to disclose information to the State.
Compliance with court orders — to comply with a judgment, decree, or order.
Medical emergency — responding to a medical emergency involving a threat to the life, or an immediate threat to the health, of any individual.
Public health — providing medical treatment or health services during an epidemic, outbreak of disease, or other threat to public health.
Disaster and public order — ensuring safety, or providing assistance or services, during a disaster or a breakdown of public order.
Employment — purposes related to employment, or to safeguard the employer from loss or liability.

Even where a legitimate use applies, other obligations under the Act — such as maintaining reasonable security safeguards and processing personal data only for the relevant purpose — continue to apply. Whether a particular activity falls within a legitimate use depends on the facts and the specific conditions in the Act.