Compare terms

Consent vs Certain Legitimate Uses

Both are lawful bases for processing under the DPDP Act. Consent is an active agreement from the individual. Certain legitimate uses are a closed list of defined situations where separate consent is not required.

Why the distinction matters

Your lawful basis decides what you have to do. Relying on consent means giving a Section 5 notice, obtaining a clear affirmative agreement under Section 6, and letting the person withdraw it as easily as they gave it. Relying on a certain legitimate use under Section 7 means no separate consent — but you can only use the data for the specific listed purpose, and the list is closed.

When each applies

Use consent for ordinary purposes the person agrees to, such as marketing or optional product features. Rely on a certain legitimate use only where the facts fit a Section 7 category exactly — for example, personal data the individual voluntarily provided for that purpose, certain employment purposes, responding to a medical emergency, or specified functions of the State. If the facts don't fit a listed use, you are back to consent.

Common confusions to avoid

Reading Section 7 like GDPR ‘legitimate interests’. It is not an open balancing test — it is a fixed list of defined situations.

Thinking a legitimate use removes every duty. It only removes the need for consent and notice for that use. Security, purpose limitation and the other obligations still apply.

Assuming consent is permanent. It can be withdrawn at any time, and processing that relied on it must stop, subject to any legal retention requirement.

Related glossary terms

Frequently asked questions