Why consent is not the only DPDP processing route

A request to “add a consent box everywhere” sounds like a quick privacy fix. It can also obscure why a business needs information and whether the person has a meaningful choice. DPDP does not make a checkbox the answer to every processing question.

Section 4 of the Act provides for processing for a lawful purpose based on consent or certain legitimate uses. The second route is defined through the particular situations in section 7. It is not permission to process anything that seems helpful to the organisation.

As at 22 October 2026, these substantive provisions are scheduled to commence on 13 May 2027 under the commencement notification. Teams can use the transition to map their activities properly while continuing to assess existing laws that apply to them.

Begin with one purpose at a time

Consider a hypothetical home-repair business. It receives a customer’s address to send a technician, a phone number to coordinate arrival and a separate request to hear about annual maintenance offers. These activities involve overlapping information but serve different purposes.

The business should not treat “customer management” as a sufficient explanation for all of them. Write the intended outcome for each use. Identify which information is needed, who receives it and what event ends the purpose. Only then ask which processing route fits.

This order matters. If the team selects a preferred legal label first, it may stretch every activity to fit that label. A purpose-level record makes a later change, such as sharing leads with another business, visible as a new question.

Read section 7(a) with its conditions

Section 7(a) addresses personal data voluntarily provided by the Data Principal for a specified purpose where the person has not indicated that they do not consent to its use for that purpose. The provision is specific about how the information was provided and the purpose involved.

The repair customer’s voluntary provision of an address to arrange the visit is materially different from a purchased list of household addresses. A phone number supplied for arrival coordination does not become a general invitation to send unrelated promotions indefinitely.

Document the facts that make the route applicable. What did the person ask for? What information did they provide? What use was specified? Did they indicate an objection to that use? A label in a spreadsheet is weak evidence if the real collection experience contradicts it.

Other certain legitimate uses are also specific

Section 7 includes other defined situations, such as particular legal obligations, emergencies and employment-related processing. Their wording matters. For example, section 7(i) concerns employment purposes and safeguarding an employer from loss or liability in the stated context. It is not a blanket exemption for every dataset an HR team can access.

Do not convert this list into a general “legitimate business interest” test. DPDP does not reproduce GDPR’s broad legitimate-interest balancing basis. Nor should a team invent a general contractual-necessity route merely because a commercial contract exists.

Where a proposed activity does not fit a section 7 provision, examine whether valid consent can support it or whether the activity should change. Consent cannot make an unlawful purpose lawful. A forced or misleading choice does not become sound merely because the business stores a timestamp.

Make consent real where you use it

Sections 5 and 6 set the relevant notice and consent conditions, including a clear affirmative action and consent that is free, specific, informed, unconditional and unambiguous. Consent is limited to personal data necessary for the specified purpose. Withdrawal must be possible with comparable ease to giving it.

For the optional maintenance offers, the hypothetical business could design a distinct choice with a clear description and an accessible way to stop. The operational review should test what happens after withdrawal, including any processor that sends messages on the business’s behalf.

Do not combine this choice with a statement that the customer must accept all marketing to book an ordinary repair. The form’s design and the downstream workflow should tell the same story.

A route does not replace accountability

The general obligations in section 8 remain relevant to covered processing, subject to the Act’s actual exceptions. A section 7 assessment does not automatically remove security, accuracy, contact or retention questions. Different provisions have their own triggers and limits.

Keep a short purpose record containing the chosen route, relevant provision, supporting facts, owner and review trigger. Revisit it when the purpose, recipient or collection experience changes. The failure to avoid is arguing about consent in the abstract while a single database quietly serves several incompatible uses.