Grounds for Processing under the DPDP Act

Summary

Consent is the primary ground for processing personal data under the DPDP Act. Apart from consent, there are certain legitimate uses for which data may be processed.
Personal data cannot be processed for any unlawful purpose under the DPDP Act.
All consent requests must be accompanied by a notice.
Unlike the GDPR, the DPDP Act has no legitimate interest ground and no contract ground for processing data.
Processing without a valid ground can attract a penalty of up to ₹50 crore.

What are the grounds for processing under the DPDP Act?

Under the DPDP Act, the primary ground for processing personal data is consent. There are also certain legitimate uses for which data may be processed without consent.

Therefore the two grounds under which personal data can be processed are:

Consent of the Data Principal, or
Certain legitimate uses.

The purpose for processing also itself has to be lawful. Consent cannot make an unlawful purpose lawful.

While the DPDP has only two grounds, under the GDPR there are six lawful bases under which personal data can be processed: consent, contract, legal obligation, vital interests, public task and legitimate interests. You can read more about how the DPDP compares to GDPR in our blog: DPDP vs GDPR.

What is a lawful purpose?

A lawful purpose is any purpose that is not expressly forbidden by law. If the purpose is prohibited under any law in force, personal data cannot be processed for that purpose, even with consent of the Data Principal.

For example, a lender collecting a borrower's contact list to call their friends and family during recovery is restricted under RBI's digital lending rules. Even if the borrower provides consent, this processing will not be legal and permitted.

Consent as a ground of processing

Consent is the primary ground most businesses will rely on for most processing, as legitimate uses are narrow grounds of processing which apply only in certain limited scenarios.

What makes consent valid?

Consent must be:

Free: not bundled with something unrelated.
Specific: consent must be tied to a stated purpose. Obtaining blanket consent for unspecified future use is no longer allowed.
Informed. The Data Principal must know what data is being collected and why.
Unconditional and unambiguous. No hidden terms or ambiguity about what was agreed to.
Given by a clear affirmative action. Pre-ticked boxes, silence and continued use of a service are not valid consent.

Consent is limited to the personal data necessary for the stated purpose. For example: If a digital lending app obtains consent to process personal information for loan servicing, it cannot process your data for marketing, unless it obtains consent separately for that purpose.

What must the valid notice look like?

Every request for consent must be accompanied by a notice which is understandable on its own, and not buried inside the privacy policy or terms of service.

The notice must contain:

an itemised description of the personal data being collected;
the specified purpose, along with a description of the goods or services the processing enables;
a link to your website or app; and
a way for the Data Principal to withdraw consent, exercise their rights, and complain to the Board.

The notice must also be available in English or any of the languages listed in the Eighth Schedule to the Constitution.

What happens when consent is withdrawn?

The Data Principal should be able to withdraw consent at any time, and withdrawing consent has to be as easy as giving it was. If consent was given with one tap, withdrawal cannot require a support ticket.

Once consent is withdrawn:

Stop processing within a reasonable time.
Make your Data Processors stop as well.
Erase the personal data, unless a law requires you to keep it.

The consequences of withdrawal have to be borne by the Data Principal, so if someone withdraws consent for processing necessary for the service being provided, you can refuse to provide the service.

Who has to prove consent was taken?

The Data Fiduciary has to prove that a valid notice was given and that consent was taken, if a question about consent comes up in a DPB proceeding. For how consent is captured and managed in practice, see Consent under the DPDP Act.

For the role of registered intermediaries, see Consent Managers under the DPDP Act.

What are legitimate uses under the DPDP Act?

Where consent is absent or cannot practically be taken, the Act lists nine situations (grouped below) in which personal data may still be processed. These are called legitimate uses.

Legitimate uses are narrow and limited grounds of processing, are meant for specific situations rather than as a general fallback for processing. If data is processed on the basis of legitimate use rather than consent, it cannot be used for any other purpose than for that legitimate use.

Legitimate Use	What it covers	Example
Data shared voluntarily	Personal data the Data Principal gives you herself for a specific purpose, where she has not indicated that she does not consent to its use.	A customer emails support with her address to ask about a delivery. You can use the address to answer her query but for no other purpose.
Legal obligations to disclose to the State	Where a law requires you to disclose information to the State or its instrumentalities.	A bank filing suspicious transaction reports with the FIU under anti-money laundering law.
Court and tribunal orders	Complying with a judgment, decree or order under Indian law, or a foreign judgment or order on a contractual or civil claim.	A company producing an employee's emails in response to a court order in a harassment case.
Employment	Processing for employment purposes, or to protect the employer from loss or liability, including preventing corporate espionage and protecting trade secrets and confidential information.	Monitoring access to a confidential product design to prevent leaks.
State functions and benefits	Processing by the State: - to issue a subsidy, benefit, service, certificate, licence or permit; and - processing by the State to perform functions under law or in the interest of sovereignty, integrity or national security.	A government department checks eligibility for a welfare scheme using data already held in a notified government database.
Medical emergencies and public health	- Responding to a threat to life or an immediate threat to health; and - Providing treatment or health services during an epidemic or other threat to public health	A hospital accessing a patient's records when she is brought in unconscious.
Disasters and breakdown of public order	Ensuring safety, or providing assistance or services, during a disaster or a breakdown of public order.	Relief agencies using resident data to run evacuation and aid efforts after a cyclone.

Most of these apply to the State or organisations acting in those situations, and not to private businesses. For a typical business only the first four apply, in very limited scenarios:

Data shared voluntarily: It covers personal data the Data Principal gives you herself for a specific purpose, and only allows you to use it for that purpose. It does not cover data you already hold from an earlier interaction, or data you obtained from a third party.
Legal obligations: It covers obligations to disclose information to the State but not every statutory duty that involves personal data. A law requiring you to retain records for ten years is handled by the retention rules, not by this ground.
Court and tribunal orders: It covers complying with an order, judgment or decree of a court or tribunal. It does not cover disclosing data in anticipation of a dispute, or handing it over on request, unless there is an order requiring it.
Employment: It covers the employment relationship and protecting the employer from loss or liability but does not extend to processing employee data for unrelated commercial purposes.

Are there any exemptions under the DPDP Act?

A legitimate use is also not an exemption. It removes the need for consent, but you still have to tell Data Principals. It removes the need for consent, but you still have to run a grievance redressal process, keep the data secure, report breaches, and erase the data once the purpose is met.

However, there are scenarios under the Act where businesses are exempt from most obligations under the DPDP. Exempted scenarios include processing data for enforcing legal rights, prevention and investigation of offences or ascertaining the financial position of a loan defaulter. To know more about exemptions, read our blog: DPDP Act Exemptions.

Consent vs legitimate use: a comparison

What happens if you process without a valid ground?

Processing personal data without consent or a legitimate use is a breach of the DPDP Act. It falls under the residual entry in the Schedule, which carries a penalty of up to ₹50 crore. The Board decides the amount after looking at the nature and gravity of the breach, the type of data involved, whether it was repeated, and what you did to mitigate it. See DPDP Act Penalties.

Frequently asked questions

Does the DPDP Act have a legitimate interest ground like the GDPR?

No. The GDPR allows processing under “legitimate interest” if an organisation needs personal data without explicit consent, if the processing is necessary for a genuine purpose and does not override the fundamental rights and freedoms of the data subject.

There is no equivalent under the DPDP Act, and "legitimate uses" are a list of nine specified situations, not a balancing test that can be applied. Processing that would qualify as legitimate interest under the GDPR will usually need consent under the DPDP Act. See DPDP vs GDPR.

What is the retention period for personal data under the DPDP Act?

The Act does not set a single retention period. Personal data must be erased when consent is withdrawn, or once the purpose is no longer being served.

However there are some retention periods laid out under the DPDP Rules for certain large e-commerce entities, online gaming intermediaries and social media intermediaries. They must erase personal data three years after the Data Principal last approached them or exercised their rights, unless a law requires them to keep it. Separately, it requires personal data and processing logs to be kept for at least one year for specified purposes. See our Data Retention Guide.

How are exemptions different from grounds for processing?

Grounds of processing allow you to process the data whereas an exemption removes specified obligations under the Act for certain kinds of processing. A legitimate use only removes the need for consent, so you still have to run a grievance redressal process, keep the data secure, report breaches, and erase the data once the purpose is met. An exemption frees you from most of these. See DPDP Act Exemptions .

When do these obligations start to apply?

The DPDP Rules were notified on 13 November 2025. The detailed notice requirements, the retention and erasure rules, and most other operational obligations take effect on 13 May 2027.

‍

Summary

Riddhi Swami

What are grounds for processing under the DPDP Act?

Consent as a ground for processing

What happens when consent is withdrawn

Legitimate uses under the DPDP Act

What happens if you process without valid ground?

FAQs

Summary

Summary