Certain legitimate uses
A Data Fiduciary may process personal data of a Data Principal for the specified legitimate uses, including where the Data Principal has voluntarily provided her personal data and has not indicated that she does not consent to its use; for the performance of any function under law, or in compliance with any judgment or order; for compliance with any judgment, decree or order; for responding to a medical emergency involving a threat to life; for taking measures to provide medical treatment during an epidemic or disease outbreak; for taking measures to ensure safety or provide assistance during any disaster or breakdown of public order; and for employment purposes, or those related to safeguarding the employer from loss, subject to reasonableness.
- This is the closest DPDP gets to a general-purpose lawful basis outside consent, but it's a closed, enumerated list — not an open standard.
- The 'voluntarily provided and did not object' ground is often used for things like a visitor signing a physical register or replying to an inbound query.
- The employment ground is narrower than many assume: it must relate to hiring, terminating, or safeguarding the employer from loss/liability, subject to a reasonableness test.
Reconstructed for readability from the publicly notified DPDP Act, 2023. Always verify exact wording against the official Gazette of India before relying on this for legal or compliance decisions.