Section 7 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 7 lists the "certain legitimate uses" that allow processing without a consent request. This article covers the first two clauses: clause (a), where a Data Principal voluntarily gives data for a specified purpose, and clause (b), where the State or its instrumentalities provide a subsidy, benefit, service, certificate, licence or permit. Later clauses are in the next two articles. To decide which of your activities can rest on these clauses, a legal consultation is a useful step.
A Data Fiduciary may process personal data for the specified purpose for which the Data Principal voluntarily provided it, unless she has indicated that she does not consent to that use (section 7(a)). The State and its instrumentalities may process data to provide a prescribed subsidy, benefit, service, certificate, licence or permit where she previously consented or the data is in a notified State database (section 7(b)), subject to standards in policy or law.
Clauses (a) and (b) at a glance
| Clause | Use | Key conditions |
|---|---|---|
| 7(a) | Specified purpose for which the Data Principal voluntarily provided her personal data | She has not indicated that she does not consent to the use |
| 7(b)(i) | State processing to provide a prescribed subsidy, benefit, service, certificate, licence or permit | She previously consented to processing by the State for any such item |
| 7(b)(ii) | Same, where the data is available in a State database, register, book or document notified by the Central Government | Data in digital form, or digitised later |
| 7(b), closing words | Standards of processing | In accordance with policy issued by the Central Government or any law in force for governance of personal data |
Clause (a): voluntarily provided data
Section 7(a) covers processing "for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data".
Break it into three conditions.
- Voluntary provision. She gave the data herself. Data collected without her involvement is not within the clause.
- A specified purpose. The use must be for the specified purpose for which she gave it. "Specified purpose" in section 2(za) means the purpose in the notice given under the Act. The clause speaks of the purpose for which she provided the data, so the processing cannot extend to other purposes.
- No indication of non-consent. If she has told the Data Fiduciary that she does not consent to the use, the clause falls away.
The Illustrations are helpful. In (I), X buys from a pharmacy and voluntarily provides her personal data and asks for a payment acknowledgement by message to her phone; Y may process it to send the receipt. In (II), X messages a real estate broker asking for help identifying rented accommodation and shares her data; Y may process it to find and tell her about accommodation. When X later says she no longer needs help, Y must cease to process her data.
The second Illustration shows the "indication" limb at work: once she says she no longer needs the service, the legitimate use ends.
What clause (a) does not allow
- A different purpose. Using a number given for a receipt for a marketing campaign goes beyond the specified purpose.
- Continuing after she says no. The clause expressly ends at her indication.
- Sidestepping the other duties. Even with a legitimate use, the Data Fiduciary remains bound by section 8 (accuracy, security, breach intimation, erasure) and section 9 for children.
The Act does not say in this clause that a notice must be given. The notice duty in section 5(1) attaches to requests for consent under section 6, not to legitimate uses. Even so, a short statement of purpose at the point of collection will help show what the "specified purpose" was.
Clause (b): State benefits, licences and permits
Section 7(b) allows "the State and any of its instrumentalities" to process personal data to "provide or issue to the Data Principal such subsidy, benefit, service, certificate, licence or permit as may be prescribed". Three features follow.
- The list of items is prescribed. The Act leaves it to the rules under section 40(2)(e) to specify the subsidy, benefit, service, certificate, licence or permit. The DPDP Rules, 2025 (notified November 2025) prescribe the detail, and different provisions commence on different dates; check the Rules. This article does not list them.
- Two routes. Either (i) she has previously consented to processing by the State or its instrumentalities for any subsidy, benefit, service, certificate, licence or permit, or (ii) the data is available in digital form in, or in non-digital form and digitised subsequently from, a database, register, book or other document maintained by the State or its instrumentalities and notified by the Central Government.
- Standards apply. The processing must be in accordance with standards followed under the policy issued by the Central Government or any law in force for governance of personal data.
The Illustration shows the first route: X, a pregnant woman, enrols on an app to get maternity benefits and consents to provide data for that. The Government may process her data to determine her eligibility for any other prescribed benefit.
Note the word "State". Section 2(zb) takes its meaning from article 12 of the Constitution, and section 2(s)(vi) includes the State within "person". Private businesses do not use clause (b) merely because they work with the government; the clause is for the State and its instrumentalities.
How clauses (a) and (b) relate to section 4
Section 4(1)(b) allows processing "for certain legitimate uses", and section 2(d) says those are the uses in section 7. So a Data Fiduciary that fits a clause of section 7 satisfies the ground requirement without a consent request. The other clauses of section 7 are covered in the articles on legal obligations, courts and State functions and on medical emergency, disaster and employment.
Practical examples
Example 1: delivery address. A customer gives her address to a courier app to deliver a parcel. The app may use it for delivery under section 7(a). Selling the address to a marketing list is outside the specified purpose.
Example 2: a stopped enquiry. A user asks a travel agent for quotes and then says she has decided not to travel. Under the Illustration logic, the agent must stop processing her data for that purpose.
Example 3: a licence renewal. A State department holds a citizen's data in a notified register and uses it to issue a licence that is on the prescribed list. That can fall under section 7(b)(ii), subject to the standards in the closing words.
Common mistakes
- Using voluntarily provided data for a new purpose.
- Ignoring a Data Principal's statement that she does not consent.
- Assuming that a private business can rely on clause (b) because it supports a State scheme.
- Assuming legitimate use removes the section 8 duties.
Need help with legitimate uses and consent mapping?
If you are unsure which of your processing activities can rest on section 7 and which need consent, a mapping exercise will show where the boundary lies. Start with our legal consultation service and we will go through your collection points and purposes.
Key takeaways
- Section 7(a) allows processing for the specified purpose for which data was voluntarily provided, until the Data Principal indicates she does not consent.
- Section 7(b) lets the State and its instrumentalities process data to provide prescribed subsidies, benefits, services, certificates, licences and permits.
- The items under clause (b) are prescribed by rules and the databases are notified.
- Legitimate use does not remove the duties in section 8.
- A different purpose needs a separate ground.
Read next
- Section 7 of the DPDP Act, 2023: legal obligations, courts and State functions
- Section 4 of the DPDP Act, 2023: grounds for processing personal data
- Section 6 of the DPDP Act, 2023: what valid consent requires
- DPDP Act key obligations for businesses in India
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.