Door two. Section 7 lists nine specific situations where an organisation can process personal data without asking first — narrower than it might sound.
A FEW EXAMPLES FROM THE LIST
VOLUNTARY
Data you handed over yourself
You give your number to a shop for a receipt — they can use it for exactly that, nothing more.
EMPLOYMENT
Managing staff and safeguarding the business
HR records, and protecting trade secrets or confidential information, without re-asking consent for routine processing.
EMERGENCIES
Medical emergencies and disasters
A hospital can pull an unconscious patient’s records without waiting on a signed form.
These nine grounds are specific and situational — they don’t add up to a general “reasonable business need” exception. Using someone’s voluntarily shared phone number to send a receipt is covered; using that same number later for marketing is a different purpose, and needs its own basis.
Common misconception — That once a legitimate use applies, ordinary privacy obligations stop mattering. They don’t — security, accuracy and accountability duties apply regardless of which of the two doors an organisation walked through.
Legitimate uses skip the consent step. They don’t skip the rest of the Act.
SOURCES The DPDP Act, 2023 — official text, MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf