Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsConcept
Certain legitimate uses are the situations in Section 7 where a Data Fiduciary may process personal data without separate consent.
TL;DR
Certain legitimate uses (Section 7) are the specific situations where a Data Fiduciary may process personal data without separate consent, such as data voluntarily provided for a stated purpose, medical emergencies, public health, disaster response and defined employment uses. They are narrow and conditional, not a general legitimate-interest catch-all.
A Data Fiduciary may process personal data of a Data Principal for any of the following uses, namely: for the specified purpose for which the Data Principal has voluntarily provided her personal data; for the State to provide subsidies, benefits, services, certificates, licences or permits; for functions of the State; for legal obligations; for court orders; for medical emergencies; for public health measures; for disaster or public order; and for specified employment purposes.
Consent is not the only lawful basis. Section 7 lists specific uses, such as data a person voluntarily provides for a stated purpose, medical emergencies, public health, disaster response and defined employment purposes.
These are narrow and defined. They are not a general 'legitimate interest' catch-all, and each has its own conditions.
A pharmacy sending a payment receipt to a customer who voluntarily gave her number for that purpose relies on a certain legitimate use, not fresh consent.
See how this term differs from the ones people most often confuse it with.
Consent vs Certain Legitimate Uses →Is this the same as GDPR legitimate interest?
No. It is a closed list of defined uses, not an open balancing test.
Does a medical emergency need consent?
No. Responding to a medical emergency is a certain legitimate use under Section 7.
Consultant-led and partner-backed.