Skip to main content
Lawful Basis Under Section 7 Without Consent | Aizzentec — page loaded
Phase 3 enforcement: 13 May 2027. The runway is now.Speak to Aizzentec +91 8220 359 506
Compliance

Lawful basis under Section 7: when consent isn't required

Section 7 lists six 'legitimate uses' that don't need consent. Most teams under-use them — or over-use them. Both are dangerous.

Compliance11 min read
By Praveen Kumar, Practice Leader — Risk, Cyber and AnalyticsCA, CISA, CEH, CDPSE, CFEPublished Updated

The six lawful bases under Section 7

Section 7 of the DPDP Act describes six 'legitimate uses' for which a Data Fiduciary may process personal data without obtaining explicit consent under Section 6:

  1. Section 7(a) — Voluntary provision: where the Data Principal has voluntarily provided their personal data for a specified purpose, and has not indicated that they do not consent.
  2. Section 7(b) — State processing: where the State or its instrumentality processes for providing or issuing subsidies, benefits, services, certificates, licences or permits.
  3. Section 7(c) — Statutory compliance: where processing is required for compliance with any law, judgment, or order.
  4. Section 7(d) — Medical emergency: where processing is required to respond to a medical emergency involving threat to the life or health of any person.
  5. Section 7(e) — Disaster / public health: where processing is required for measures during a disaster or breakdown of public order.
  6. Section 7(g) — Employment: where processing is for purposes of employment, including for safeguarding the employer from loss or liability.

The under-use problem

Many teams insist on consent for processing that is clearly within Section 7(a) voluntary provision — like processing the email a customer typed into a contact form, or processing the address typed into a checkout. The result is consent fatigue (banners on banners), which itself violates the spirit of Section 6 (consent must be free).

The over-use problem

The opposite is more common and more dangerous. Marketing teams claiming Section 7(a) for sending promotional emails because the user 'voluntarily provided' their address at signup — when the user provided it for account creation, not marketing. Section 7(a) does not extend to processing for purposes other than the one for which the data was provided.

How to choose

The basis-selection test we use with clients:

  1. Is processing strictly necessary for the service the user requested? → 7(a) voluntary provision
  2. Is processing required by a specific law, judgment or order? → 7(c) statutory
  3. Is the user being asked to opt-in to something beyond the core service? → S.6 consent
  4. None of the above? → reassess whether you should be processing at all
Practitioner tip
Document your lawful-basis decision for every processing purpose in your RoPA. When the regulator asks why you processed without consent, the answer must be specific: which subsection of Section 7, and what processing it covers.
All knowledge articles

Related articles