TheDPDPAct.com -
Official WhatsApp Channel
Stay updated with the latest DPDP Act news, compliance insights, updates, and resources.
Join Our WhatsApp Channel →When we review a company's data-processing register for the DPDP Act, we tend to read the "lawful basis" column first. It is the shortest column, and it usually tells us the most. If every row says the same thing, and the thing it says is "legitimate interest," we already know how the register was built: someone took a template from a European programme, translated the headings, and moved on. The trouble is that Indian law does not use that phrase. Below, we walk through four invented but typical entries and show what a careful reviewer would do with each.
First, What the Act Gives You
Section 4 of the DPDP Act allows personal data to be processed for a lawful purpose in two situations: with the Data Principal's consent, or for "certain legitimate uses." Section 7 spells those uses out, and the list is specific. It covers data a person voluntarily provided for a stated purpose, certain State benefits and functions, legal disclosures and court orders, medical emergencies, public-health responses, disasters, and employment-related purposes including protecting an employer from loss or liability.
There is no open category for "the business has a good reason." That single observation settles most of what follows. (For context, the European concept in Article 6(1)(f) of the GDPR works differently: the organisation names its own interest and balances it against the individual's rights. The EDPB's draft guidelines from October 2024 describe it as a three-part test. It is a different mechanism, which is why the label does not travel.)
Entry One: "Personalised offers from purchase history"
- What the register says: Lawful basis: legitimate interest.
- What we would write in the margin: Which provision of the Act? Marketing and profiling are not named in Section 7. ELP Law's December 2025 commentary says commercial analytics, targeted advertising, customer profiling, and loyalty programmes generally need consent, and that view matches the Act's structure.
- Likely fix: Treat it as a consent-based activity. That means a clear notice naming this purpose, a way to decline without losing the core service, and an equally easy way to withdraw later.
Entry Two: "Delivery address used to deliver the order"
- What the register says: Lawful basis: legitimate interest.
- What we would write in the margin: This one is probably fine in substance and wrong in label. The customer handed over the address precisely so the parcel would arrive. The voluntary-provision use in Section 7 is built for that situation, provided the purpose was specified and the person has not indicated they do not consent.
- The catch: The use is tied to the purpose given. If the same address later feeds a marketing list, that is a new purpose and Entry One's analysis applies. Registers that give one broad ground to a whole data set often hide this drift.
- Likely fix: Change the label to the actual Section 7 use, and record the specific purpose it covers.
Entry Three: "Employee device and email monitoring"
- What the register says: Lawful basis: legitimate interest, security.
- What we would write in the margin: Here the Act does provide something. Section 7 includes employment-related purposes and safeguarding the employer from loss or liability, with examples such as preventing corporate espionage and protecting trade secrets. So the right family exists, and the entry should cite it.
- The catch: Naming the provision is the start, not the end. ELP Law's commentary suggests regulators and courts may still ask whether the processing is necessary for the stated use and proportionate to it. That is an expectation to plan for, not settled law. Blanket, always-on monitoring that reaches personal messages will be harder to defend than targeted monitoring tied to a defined risk.
- Likely fix: Cite the employment provision, define what is monitored and why, tell employees, and review the scope periodically.
Entry Four: "Disclosure to a tax or regulatory authority on demand"
- What the register says: Lawful basis: legal obligation.
- What we would write in the margin: "Legal obligation" is a GDPR-style label, but this entry lands closer to the Act than the others. Section 7 recognises processing to meet a legal obligation to disclose information to the State, following the disclosure rules in the relevant law, and processing to comply with court orders.
- Likely fix: Re-label to match the statutory wording, and note the specific law or order requiring the disclosure. Keep a record of what was shared and when.
What the Four Entries Teach
Three patterns repeat across almost every register we see.
* The label is borrowed, the analysis is missing. A reviewer cannot tell which Section 7 use, if any, the team had in mind.
* One ground is stretched across several purposes. The delivery address example shows how a valid use for one purpose quietly covers another.
* No one decided between "listed use" and "consent." Where no Section 7 use fits, the fallback is consent. Teams that never ask the question default to the template's answer.
A Note on Assessments Borrowed From Elsewhere
Many groups also keep a legitimate interest assessment from their GDPR work. That is a perfectly good internal risk document. Just label it for what it is: a group policy or voluntary control, not a DPDP requirement. Mixing the two leads auditors to ask for evidence that the Act does not demand, and leads your own staff to believe a box has been ticked when it has not.
The Clock
The Rules notified in November 2025 stage the main duties for about mid-May 2027. Nobody enjoys re-papering a register, but the work is proportionate: start with the rows that touch the most people or the most sensitive data, and fix those first.
Where ILLUME Intelligence Can Help
ILLUME Intelligence's DPDP compliance services include reviewing how your processing activities are recorded, mapping each to the Act's grounds, and flagging where consent, notices, or controls need to change. If you want ongoing ownership of this, our DPO Services provide a named privacy lead. A line-by-line register review of your most significant activities is a sensible first engagement. For individual legal judgements, we recommend working alongside your counsel.
The Bottom Line
A lawful-basis column is only useful if each row can answer one question: which provision of the Act are we relying on? Rows that say "legitimate interest" usually cannot. Rows that cite a Section 7 use, or point to a consent record, can. Fixing the column is an afternoon's work for a handful of entries and a project for a few hundred, which is a good reason to begin before the deadline sets the pace.
