Consent and lawful basis
What is legitimate use under Section 7?
- Short answer
- Legitimate uses are a fixed list of situations where personal data may be processed without consent. They include voluntary provision for a specified purpose, processing by the State for benefits and services, medical emergencies, disasters, and processing necessary for employment.
The critical feature is that the list is closed. You either fit an entry or you do not. There is no residual category for processing that seems reasonable or commercially necessary.
The employment entry is the one most organisations rely on. It covers processing necessary for the purposes of employment, and for safeguarding the employer from loss or liability, which carries most routine HR processing.
Where you rely on a legitimate use rather than consent, there is no consent to withdraw, and the Section 5 notice duty is engaged differently. That is a simplification, not a licence to do more with the data.
Where this comes from
- Section 7, DPDP Act 2023
The mistake people make
Stretching a listed use to cover marketing or profiling that has nothing to do with the purpose the entry describes.