DPDP reference

Section 7: Certain legitimate uses

Last checked 6 Nov 2026

These are the uses that do not need consent under s.6. They are: personal data the Data Principal voluntarily gave for a specified purpose, where she has not objected (s.7(a)); State subsidies, benefits, services, certificates, licences and permits (s.7(b)); State functions under law and sovereignty or security (s.7(c)); legal duties to disclose to the State (s.7(d)); and compliance with judgments and orders (s.7(e)).

The list continues with medical emergencies (s.7(f)), treatment and health services during an epidemic or other threat to public health (s.7(g)), safety and assistance during a disaster or breakdown of public order (s.7(h)), and employment purposes, including safeguarding the employer from loss or liability (s.7(i)).

Applies to
Every Data Fiduciary, of any size, unless an exemption in s.17 applies.
Starts
13 May 2027 (G.S.R. 843(E), item (c)).
Penalty
Up to ₹50 crore (s.33, Schedule item 7).
Source
Digital Personal Data Protection Act, 2023 (22 of 2023), section 7; G.S.R. 843(E), commencement

Questions

Is consent needed for employee data under the DPDP Act?

Not where the processing is for the purposes of employment or for safeguarding the employer from loss or liability (s.7(i)).

Can a shop use a mobile number the customer gave for a receipt?

Yes. The Act's own illustration is a pharmacy sending a receipt to a number the customer gave for that purpose (s.7(a)).

Related

Next

Join early access

Not legal advice.