Under the DPDP Act 2023, you can process personal data on only two grounds: the Data Principal's consent, or one of the specific legitimate uses set out in Section 7 — such as data voluntarily provided for a purpose, certain state functions, employment purposes, medical emergencies, or specified public-interest situations. If your processing does not fit a Section 7 legitimate use, you need valid consent. This checker tests what you are processing and why, then tells you whether you can rely on a legitimate use or must obtain consent.
Are you processing personal data on a lawful basis? Test whether your activity fits a Section 7 legitimate use or needs the Data Principal's consent.
The DPDP Act 2023 keeps the lawful bases deliberately narrow. You may process personal data with the Data Principal's consent, or under one of the legitimate uses enumerated in Section 7. Those legitimate uses include data voluntarily provided by the Data Principal for a purpose they have not objected to, certain functions of the State, compliance with legal obligations and judgments, medical emergencies, threats to life or safety during disasters, and specified employment purposes. There is no open-ended legitimate interest ground like some other regimes have.
This matters because a lot of everyday processing that companies assume is fine — building marketing profiles, sharing data with partners, enriching records from third parties — does not map to any Section 7 legitimate use. For those activities, consent is not optional; it is the only available basis. Getting the classification right per activity is the foundation everything else rests on.
Every downstream obligation — notices, records, retention, DSAR handling — depends on you first knowing why you are lawfully allowed to process each dataset. If you rely on a legitimate use that does not actually apply, the whole chain is exposed, because there was never a valid basis to begin with. Conversely, mislabelling something as needing consent when a legitimate use applies creates unnecessary friction and consent fatigue.
Niti Bharat runs this classification exercise for Indian mid-market companies as part of its fixed-price DPDP engagements — mapping each processing activity to consent or a Section 7 legitimate use, documenting the reasoning, and flagging where consent must be obtained. Getting the lawful-basis map right early is what prevents expensive rework closer to the expected May 2027 enforcement date.
A worksheet that maps each of your processing activities to consent or a Section 7 legitimate use, with prompts to document the reasoning for each.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
