Section 4 permits processing for a lawful purpose where the Data Principal has given consent or where the processing falls within certain legitimate uses. Section 7 then defines those uses. The heading can be misleading for readers familiar with the GDPR: it does not create a broad business-interest balancing test.
A useful rationale begins “section 7 clause…” and explains the facts. It does not begin “this benefits the business.”
Use the two-route model
| Route | When it applies | Key evidence |
|---|---|---|
| Consent | The Data Principal makes a free, specific, informed, unconditional and unambiguous choice through clear affirmative action. | Notice, purpose, interface or channel, choice, timestamp, version and withdrawal process |
| Section 7 | The processing facts satisfy a named statutory use and its conditions. | Clause selected, factual rationale, data and purpose limits, owner, review and cessation trigger |
Do not choose section 7 merely because consent would be inconvenient, and do not seek consent where the organisation intends to process regardless of refusal. Select the route that accurately matches the purpose and facts.
The section 7 grounds
| Clause | Statutory use | Boundary to document |
|---|---|---|
| 7(a) | Specified purpose for which the person voluntarily provided data and has not indicated that they do not consent to that use. | The exact context and specified purpose; cease when the person indicates the purpose is no longer wanted. |
| 7(b) | State provision or issue of a prescribed subsidy, benefit, service, certificate, licence or permit in specified circumstances. | State status, prescribed benefit, qualifying data source, notification and governing standards. |
| 7(c) | State function under Indian law, or interests of sovereignty, integrity or State security. | The function, legal authority or protected State interest and necessity of the data used. |
| 7(d) | Fulfilling an obligation under Indian law to disclose information to the State or its instrumentalities. | The specific disclosure obligation and compliance with that law’s disclosure conditions. |
| 7(e) | Compliance with an Indian judgment, decree or order, or specified foreign contractual or civil claims order. | The order, jurisdiction, scope, data required and parties authorised to receive it. |
| 7(f) | Response to a medical emergency threatening life or immediately threatening health. | The emergency, urgency, person affected and data necessary for response. |
| 7(g) | Medical treatment or health services during epidemic, disease outbreak or other public-health threat. | The public-health context, service and limits of the processing. |
| 7(h) | Safety, assistance or services during a disaster or breakdown of public order. | The qualifying event, affected individuals, assistance and cessation point. |
| 7(i) | Employment purposes or safeguarding the employer from specified loss or liability, including services or benefits sought by an employee. | Employee status, genuine employment purpose, proportionality and link to the listed protection or benefit. |
Apply clause 7(a) narrowly
Clause 7(a) turns on personal data being voluntarily provided for a specified purpose and no indication that the person does not consent to that use. The Act’s illustrations concern sending a requested receipt and helping to find rented accommodation. In the second, processing must stop when the individual says help is no longer needed.
| Question | Why it matters |
|---|---|
| What did the person actively provide? | Data inferred, purchased or obtained elsewhere does not become voluntary merely because the organisation possesses it. |
| What specified purpose was apparent? | The use should match the context understood at collection, not a later broad purpose. |
| Has the person objected or indicated they do not want the use? | The clause expressly depends on no contrary indication. |
| Has the requested purpose ended? | Continued processing needs another valid basis and retention justification. |
| Would the new use surprise the person? | Marketing, profiling or unrelated product improvement should not be stretched from a service request. |
Set boundaries around employment
Clause 7(i) covers employment purposes and purposes related to safeguarding an employer from loss or liability, with examples such as corporate espionage, confidentiality, trade secrets, intellectual property and classified information, as well as providing a service or benefit sought by an employee.
It is not an unlimited employee-surveillance ground. Document the employment connection, purpose, data necessity, access, retention and safeguards. Candidates, former employees, contractors and gig workers should not be treated as employees automatically; analyse their status and the actual purpose.
- Name the employment purpose or employer protection relied on.
- Explain why each data element is necessary.
- Assess whether monitoring is targeted or continuous.
- Restrict access and define a retention trigger.
- Provide appropriate transparency even where consent is not used.
- Reassess when the person’s status or the monitoring purpose changes.
Keep emergency grounds tied to the event
Clauses 7(f), 7(g) and 7(h) address life or health emergencies, public-health threats, disasters and breakdowns of public order. Record the event, urgency, people affected, data used, recipients and why ordinary processes could not meet the need. When the emergency context ends, stop or remap continuing processing.
Where organisations over-read section 7
| Error | Better question |
|---|---|
| “The person gave us the data, so any use is legitimate.” | What specified purpose did the person voluntarily provide it for? |
| “This is useful to the business, so legitimate use applies.” | Which exact section 7 clause contains this use? |
| “Any legal obligation fits clause 7(d).” | Is there an Indian-law obligation to disclose information to the State, and are its conditions met? |
| “Employment covers every workforce activity.” | What employment or employer-protection purpose applies, and to which person? |
| “Emergency processing can continue afterwards.” | When did the qualifying event end, and what basis supports any continuing use? |
| “Section 7 means no notice or controls.” | Which other Data Fiduciary duties, rights, security and retention requirements still apply? |
Other duties still apply
Using section 7 removes the need to obtain consent for that processing; it does not remove accountability. Apply purpose limitation, accuracy where relevant, security safeguards, breach intimation, erasure or retention rules, contact and grievance arrangements, processor oversight, children’s obligations where applicable and Data Principal rights under the framework.
Transparency remains operationally important. Describe the processing honestly in notices and internal records, particularly where people may not expect the use or where State, employment or emergency processing has significant effects.
Document the decision
| Field | What to record |
|---|---|
| Processing activity | Purpose, people, data, systems, recipients and locations. |
| Clause | The exact section 7 paragraph relied upon. |
| Facts | How the circumstances satisfy every condition of the clause. |
| Limits | Data minimisation, access, disclosure and purpose boundaries. |
| Cessation trigger | Objection, end of request, emergency, employment or legal requirement. |
| Other duties | Notice, security, retention, rights, processor and grievance controls. |
| Owner and approval | Business owner, privacy review, decision date and next review. |
| Change triggers | New purpose, data, recipient, technology, location or affected group. |
Use a repeatable workflow
- Describe the purpose precisely. Avoid labels such as “operations” or “business need.”
- Check section 7 clause by clause. Do not reason from convenience.
- Test every condition. Record evidence and contrary facts.
- If no clause fits, assess consent. Design genuine choice and withdrawal.
- Apply all remaining duties. Map notice, security, retention, rights and grievance controls.
- Approve and register. Link the rationale to the RoPA or processing inventory.
- Review on change. A new purpose or recipient can invalidate the original mapping.
References and scope
- Digital Personal Data Protection Act, 2023 (India), sections 4, 6, 7 and 8.
- Digital Personal Data Protection Rules, 2025 and the official enforcement timeline and commencement notifications.
- Regulation (EU) 2016/679 (GDPR), Article 6, only as a comparison with a different lawful-basis model.
General information for practitioners, not legal advice. Applicability depends on the exact purpose, facts, status of the person, statutory conditions and commencement. Verify current official texts and obtain qualified advice for borderline or consequential processing.