Can I just keep using "legitimate interests" as a basis in my Indian privacy policy?

No. DPDP has no equivalent to GDPR Article 6(1)(f). Every processing activity needs to run on consent under section 6 or on one of the nine grounds in the closed list at section 7.

What happens if a use doesn't fit any of the nine section 7 grounds?

Then it needs consent. There's no residual or catch-all category, so a use that isn't on the list and wasn't consented to isn't lawful processing under the Act.

Does DPDP give any right to export personal data, like GDPR's portability right?

No. Sections 11 to 14 set out a closed list of rights: access, correction, erasure, grievance redressal, and nomination. There's no equivalent to GDPR Article 20.

Is health or biometric data treated as a special category under DPDP?

No. GDPR Article 9's sensitive-data category has no DPDP counterpart, so health and biometric data sit at the same statutory tier as any other personal data.

Can I keep marketing to my existing customer list the way I did under GDPR legitimate interests?

You'll need a consent gate, or a specific fit inside the section 7 list, since ordinary marketing to existing customers doesn't sit on that closed list on its own.

"Our privacy policy is GDPR-compliant" doesn't answer the DPDP question

3 min read

dpdpgdprconsentprivacy-policy

Need help with dpdp? We can handle it for you.

"We already did GDPR, so India should be a formality." We hear a version of this from almost every founder who has a European customer base or an EU-trained legal advisor. It's a fair instinct. GDPR is the most thorough data protection law most people have encountered, and reusing that work feels efficient. The trouble is that one clause carrying a large share of a typical GDPR programme doesn't exist in Indian law at all.

The clause that's missing

GDPR Article 6(1)(f), legitimate interests, is the lawful basis European privacy teams reach for constantly. Marketing to an existing customer, running product analytics, screening for fraud: a European DPO runs a balancing test, documents it, and moves on. It's flexible by design, which is exactly why it carries so much of the weight in a GDPR programme.

DPDP has no equivalent ground. Processing personal data in India runs on one of two rails: consent under section 6, or the closed list of legitimate uses in section 7. There's no third option, no balancing test, no catch-all for "we have a good reason."

The closed list, in full

Section 7 sets out nine grounds, each specific, none of them a blank cheque:

Clause	Ground
7(a)	Data voluntarily provided by the person for a specified purpose, where she has not objected
7(b)	State provision of a subsidy, benefit, service, certificate, licence or permit
7(c)	A State function under law, or sovereignty, integrity and security of the State
7(d)	Compliance with a legal obligation to disclose information
7(e)	Compliance with a judgment, decree or order of a court or tribunal

This article is general information, not legal advice. If you need advice for your specific situation, contact BuildWright directly.

From the blog

DPDP has no materiality threshold for breach notification, and that changes what "minor incident" means DPDP's staggered commencement dates: what applies when, and why the gap still matters A Consent Manager is not something your company needs to register with

Prefer to skip the paperwork?

BuildWright can take this off your plate — done properly, the first time.

Get new templates and compliance updates by email.

"Our privacy policy is GDPR-compliant" doesn't answer the DPDP question

The clause that's missing

The closed list, in full

Where this actually bites

Two more gaps in the same policy

What to actually do with a GDPR-derived policy

Frequently asked questions