Processing personal data WITHOUT consent is permitted under Section 7 of the DPDP Act, 2023 for 'legitimate uses', which include:

Section 7 of the DPDP Act enumerates the LEGITIMATE USES for which personal data may be processed without consent, including: to enable the State to perform its functions (providing subsidies, benefits, services or issuing certificates under a law); for compliance with legal obligations; for employment or safeguards; to respond to a medical emergency; for public health; and to make a one-time provision of data to a user on the user's request. These carve-outs are finite and purpose-bound, not open-ended profit-making licences. They complement the consent mechanism of Section 6.