How to Rely on the Employment Legitimate Use Under Section 7(i) of the DPDP Act
Most DPDP advice to employers starts with consent, which is the wrong starting point for an employment relationship. The Act provides a separate ground, and the employment legitimate use in clause (i) of section 7 carries a different set of consequences from consent: no notice obligation, and, on the text, no access or correction right running against the employer. The savings are real and so are the traps.
Step 1: Fix the Commencement Position
Section 7 belongs to the group that comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. Nothing in this analysis is an obligation today.
It is nonetheless work to do now, because the choice of ground determines what has to be built. A consent architecture for employee data and a legitimate use architecture are different systems, and an employer that builds the first by default will have built the more expensive one.
Step 2: Place Clause (i) Within Section 4
Section 4(1) permits a person to process the personal data of a data principal only in accordance with the provisions of the Act and for a lawful purpose, either for one for which the data principal has given her consent or for certain legitimate uses. Section 4(2) defines a lawful purpose as any purpose which is not expressly forbidden by law.
Consent and legitimate use are therefore alternatives, not a hierarchy. An employer relying on clause (i) is not relying on an exemption from the Act, and the lawful purpose requirement still has to be satisfied independently.
Step 3: Read the Clause and Respect Its Limits
Clause (i) covers processing for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a data principal who is an employee.
Three limits follow from those words. The clause is tied to the purposes of employment and to the employer's protection from loss or liability, so a purpose outside both is outside the clause. The examples are given as illustrations of the protective limb rather than as a closed list. And the last limb speaks of a service or benefit sought by a data principal who is an employee, so it is engaged by the employee asking rather than by the employer deciding.
Step 4: Note That the Notice Obligation Does Not Follow
Section 5(1) provides that every request made to a data principal under section 6 for consent shall be accompanied or preceded by a notice given by the data fiduciary. The obligation attaches to the consent request. Section 5(2) extends it to consent given before commencement, and section 5(3) governs the language of the notice.
On the text, processing on a legitimate use under clause (i) does not trigger a section 5 notice, because there is no consent request to accompany. That is a drafting consequence rather than a licence, and an employer that tells its workforce nothing at all will find the position hard to defend under the obligations that do apply.
Step 5: Check Which Rights Actually Run Against the Employer
This is the part of the analysis most often got wrong, and it turns on an express qualifier. Section 11(1) gives the data principal the right to obtain a summary and the sharing details from the data fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7. Section 12(1) gives the right to correction, completion, updating and erasure of personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7.
Both sub-sections name clause (a) and neither names clause (i). So where the processing rests on the employment legitimate use rather than on consent, those two rights do not on their terms attach. Section 13 is drafted differently and carries no such qualifier, so the right to readily available means of grievance redressal applies whatever the ground, and section 13(3) requires the data principal to exhaust it before approaching the Board.
Step 6: Apply the Section 8 Obligations in Full
The obligations in section 8 are not switched off by the choice of ground. Section 8(1) makes the data fiduciary responsible for complying with the Act and the rules, irrespective of any agreement to the contrary or any failure of the data principal to carry out her duties, in respect of processing undertaken by it or on its behalf by a data processor. Section 8(5) requires it to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent a personal data breach.
Two points follow for an employer. The contractual route is closed, because section 8(1) says so expressly, and an employee's own breach of her duties does not reduce the employer's responsibility. Clause (i) itself contains no purpose limitation and no retention test, so whatever discipline exists on those questions comes from section 8 rather than from the clause.
Step 7: Separate the Population and Record the Ground
Clause (i) speaks of a data principal who is an employee. Applicants, former employees whose purpose of employment has ended, contractors who are not employees and family members covered by a benefit are each a different question, and an employer that processes all of them on a single asserted ground has not done the analysis.
Record the ground relied on for each processing activity at the time it is designed, with the purpose expressed in the clause's own terms. The ground determines the notice position and the rights position, so a file that does not state which ground was used cannot answer either question later.
Common Pitfalls to Avoid
Collecting consent by default: Section 4(1) treats consent and certain legitimate uses as alternatives, and clause (i) is available for the purposes of employment.
Reading clause (i) as a general employer exemption: It is a ground for processing under section 4, not an exemption from the Act.
Assuming a section 5 notice is still required: Section 5(1) attaches the notice to a request for consent under section 6.
Assuming the access and correction rights apply: Sections 11(1) and 12(1) are expressed to run against a data fiduciary to whom consent was previously given, including consent under clause (a) of section 7.
Overlooking grievance redressal: Section 13 carries no consent qualifier and section 13(3) makes it the step before the Board.
Relying on a contractual carve out: Section 8(1) applies irrespective of any agreement to the contrary.
Treating applicants and former employees as employees: The clause speaks of a data principal who is an employee, and the purposes of employment limb ends when the purpose does.
Key Statutory Provisions
Section 7 of the Digital Personal Data Protection Act, 2023: Certain legitimate uses. Clause (i) permits processing for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a data principal who is an employee.
Section 4 of the Act: Grounds for processing personal data. Processing is permitted only in accordance with the Act and for a lawful purpose, for which consent has been given or for certain legitimate uses, a lawful purpose being any purpose not expressly forbidden by law.
Section 5 of the Act: Notice. Every request made to a data principal under section 6 for consent must be accompanied or preceded by a notice, with sub-section (2) covering consent given before commencement and sub-section (3) the language of the notice.
Section 11, section 12 and section 13 of the Act: The rights to access information and to correction and erasure are each expressed to run against a data fiduciary to whom consent was previously given, including consent as referred to in clause (a) of section 7, while the right of grievance redressal is not so qualified.
Section 8 of the Act: General obligations of a data fiduciary. Sub-section (1) imposes responsibility irrespective of any agreement to the contrary or any failure by the data principal to carry out her duties, and sub-section (5) requires reasonable security safeguards to prevent a personal data breach.
Sources and References
Section 7 of the Digital Personal Data Protection Act, 2023, bare text
Section 12, right to correction and erasure of personal data
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapters II and III
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments