Consent vs legitimate use under DPDP: which applies?
When you need consent — and the narrow cases where you don't.
What legitimate uses cover
The Act enumerates specific legitimate uses: data a person voluntarily gives for an evident purpose, employment-related processing, compliance with legal obligations and court orders, responding to emergencies and disasters, and certain state functions. If your processing squarely fits one of these, you don't need consent for it.
What it does not cover
You cannot label routine commercial activities — promotional emails, behavioural advertising, profiling — as a legitimate use. For those, consent is required. The legitimate-use route is a precise carve-out, not a catch-all to avoid asking.
Pick the basis per purpose
Map each processing purpose to a basis. Payroll might rest on a legitimate use; your newsletter needs consent. Documenting which basis applies where is part of accountability and makes a DSAR or audit far easier to answer.
Frequently asked questions
Can I market to customers under legitimate use?
No. Promotional marketing requires consent. Legitimate uses don't extend to advertising or non-essential analytics.
Is employment processing a legitimate use?
Yes, certain employment-related processing is a recognised legitimate use, so it may not need consent — but transparency and security still apply.
How do I decide which basis to use?
Map each purpose to a basis: use a legitimate use only if it squarely fits the Act's list; otherwise obtain consent.
Sort consent from legitimate use
Read our plain-language guide to mapping each purpose to the right lawful basis.
Consent vs Legitimate Use