InfraVeritas360DPDPiq

DPDP Insights › The law › Section 7

What it means in your sector

• Banking, financial services and insurance: KYC, PMLA reporting and regulator returns are legal duties under Section 7. Fraud checks and loan servicing usually rest on the purpose the customer gave the data for.
• IT, ITeS, BPO and GCC: Payroll, access control, background checks and security monitoring of staff are employment purposes.
• Central government: ministries and departments: Section 7(b) covers subsidies, benefits, services, certificates, licences and permits; Section 7(c) covers functions under law.
• Public sector undertakings and utilities: Employment purposes cover most workforce data. Whether Section 7(b) applies to subsidy work depends on the PSU's status and the scheme.
• Healthcare and hospitals: A medical emergency involving a threat to life and health services during an epidemic are listed uses. Routine treatment data is usually given voluntarily for that purpose.

Questions where this section matters

• When do we need consent, and when can we rely on a legitimate use?
• Do we need consent for employee data?
• Are contract and agency workers our responsibility?
• What about CCTV, visitor registers and biometric attendance?
• Police, a court or a regulator asks for someone's data. What do we do?
• How long must we keep KYC and transaction records, and what happens after?
• Do we need citizens' consent to run a scheme?
• What do the Second Schedule standards ask of a scheme?
• How does the RTI amendment change replies about personal information?
• How should scheme systems handle Aadhaar numbers?
• Can we share data with states, banks or other ministries?
• Is our PSU 'the State' under DPDP, and what changes if it is?
• Do we need DPDP consent to treat a patient?
• Can we share patient records with insurers and TPAs?

Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.