Consent and lawful basis
Does DPDP require consent for everything?
- Short answer
- No. Consent under Section 6 is the main route, but Section 7 lists certain legitimate uses that do not need it, including processing necessary for employment. Section 7 is a closed list, not a general balancing test you can reason your way into.
This is the most consequential misunderstanding in the Act, in both directions. Some organisations try to obtain consent for everything, including processing where consent is inappropriate and cannot meaningfully be refused. Others assume a broad legitimate interest style basis exists.
There is no lane marked because it makes commercial sense. If your purpose does not fit a listed legitimate use, consent is the basis, and it must be free, specific, informed, unconditional and unambiguous with a clear affirmative action.
Getting this right early is worth the effort, because the lawful basis you pick determines the notice you must give and whether a withdrawal right applies.
Where this comes from
- Section 6 and Section 7, DPDP Act 2023
The mistake people make
Treating Section 7 as though it were the GDPR's legitimate interests, which allows a balancing exercise. It does not.