Both are lawful bases for processing under the DPDP Act. Consent is an active agreement from the individual. Certain legitimate uses are a closed list of defined situations where separate consent is not required.
Consent
Certain Legitimate Uses
What it is
An active, informed agreement by the Data Principal.
A defined use listed in Section 7.
Statutory reference
Section 6
Section 7 (defined in 2(d))
Needs the person to agree?
Yes, by a clear affirmative action.
No separate consent is required for the listed use.
Can it be withdrawn?
Yes, at any time.
Not applicable; it does not rest on consent.
Scope
Any lawful purpose the person agrees to.
Only the specific uses the Act lists.
Everyday example
Agreeing to marketing emails.
Responding to a medical emergency.
Do I always need consent?
No. Where a certain legitimate use in Section 7 applies, separate consent is not required.
Is 'legitimate use' a general balancing test?
No. It is a closed list of defined situations, unlike an open legitimate-interest test.