Module 4 of 9Section 76 min including the detail
When you do not need consent
Section 7 lists the certain legitimate uses that stand on their own. Read it precisely, because it is both narrower and broader than people assume.
The list is closed
There is no legitimate interests ground and no balancing test in this Act. Either you are on the list, or you need consent.
The whole list
- Voluntarily providedfor a specified purpose, and not objected to
- Certain State functionssubsidies, benefits, services, certificates, licences, permits
- Legal obligationcompliance with a law or a judgment
- Medical emergencyor a threat to life
- Epidemic or public healthemergency measures
- Disaster or public orderbreakdown of public order
- Employment purposesincluding protecting the employer from loss
The detail, if you want it
There is no general balancing test in this Act. There is no equivalent of legitimate interests as a catch-all to be argued case by case. Either your processing falls inside one of the listed uses or it needs consent.
The uses include: data the person voluntarily provided for a specified purpose and has not objected to; certain State functions for subsidies, benefits, services, certificates, licences and permits; compliance with a law or a judgment; a medical emergency or a threat to life; an epidemic or public health emergency; a disaster or breakdown of public order; and purposes of employment, including protecting an employer from loss and providing a service or benefit to an employee.
The employment ground is real, and it is not unlimited
It means you never have to ask an employee to consent to payroll. It does not stretch to monitoring that serves some other purpose.
The detail, if you want it
This is the ground most organisations will actually use, and it is genuinely useful: it means you do not need to ask an employee to consent to payroll. Consent from an employee would in many cases fail the free test anyway, because of the power imbalance.
What it does not do is cover everything an employer might want. It is tied to purposes of employment, to protecting the employer from loss or liability, and to providing services or benefits to the employee. Monitoring that serves a different purpose does not become lawful because the person is an employee.
The voluntary provision ground is the one most often stretched
Someone who gave an email address to receive an invoice did not give it for a marketing campaign. And section 7 removes the need for consent, never the duties in section 8.
The detail, if you want it
Where a person voluntarily gives you their data for a specified purpose, and has not indicated they object, you may process it for that purpose. The limit is in the words specified purpose. Someone who gives you an email address to receive an invoice has not provided it for a marketing campaign.
Note also what section 7 does not switch off. The duties in section 8 apply regardless of which ground you rely on. Relying on a legitimate use removes the need for consent, not the need for security, accuracy, erasure or a grievance route.
The three things to remember
- The section 7 list is closed. This Act has no legitimate interests ground and no balancing test.
- Employment purposes cover payroll. They do not cover whatever else an employer would like to do.
- Voluntary provision is bounded by the purpose the data was given for.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- A processing register naming, for every activity, the single ground it relies on.
- For any activity relying on section 7, the specific listed use quoted, not paraphrased.
- A review that no activity is relying on a general balancing argument, because the Act provides none.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.