Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.
Most of the time a company needs your consent. Section 7 lists "certain legitimate uses" where it does not. People sometimes call this deemed consent.
The nine legitimate uses, in plain words
- (a) You gave your data yourself for a purpose and did not say no to its use. Example from the Act: you give your number to a pharmacy to get a receipt by SMS. If you later tell them to stop, they must stop.
- (b) The Government giving you a subsidy, benefit, service, licence or permit, using data you gave before or data in its notified records.
- (c) The Government doing a function under law, or for sovereignty, integrity or security of India.
- (d) Meeting a legal duty to share information with the Government.
- (e) Following a court judgment, decree or order.
- (f) A medical emergency that threatens life or health.
- (g) Treatment or health services during an epidemic or public health threat.
- (h) Safety and help during a disaster or breakdown of public order.
- (i) Employment, or protecting the employer from loss or liability (for example trade secrets), or giving an employee a service they asked for.
How this affects your rights
- The access right (section 11) and the correction and erasure right (section 12) apply to data you gave with consent, and to data under clause (a). They do not clearly reach the other clauses.
- The company still has to protect your data, keep it accurate when used for decisions, and report breaches (section 8), whatever the basis.
- You can always use the grievance route (section 13).