Legitimate use vs optional consent in DPDP: when to ask

Legitimate use means a person gave you their details themselves, for one specific thing, so you show them a notice and use the data only for that. Consent means the person opts in, with an unticked box, to something extra that they are free to refuse. Under India’s DPDP Act, the difference decides whether you need a checkbox or just a clear notice.

This guide gives you a simple test, real examples and the common mistakes to avoid.

The one-question test

Ask: did the person hand over this data themselves, for exactly this purpose?

• Yes, and you use it only for that. This is legitimate use. Show a notice. No checkbox is needed.
• No, it is something extra. This needs consent. Offer an unticked box, and keep it optional.

Examples

Situation	What it is	What to show
Someone fills a demo form and you reply to them	Legitimate use	Notice only
You send them a monthly newsletter afterwards	Consent	Unticked checkbox
A customer raises a support ticket and you answer it	Legitimate use	Notice only
You send product updates by email	Consent	Unticked checkbox
Analytics cookies on your website	Consent	Banner with an opt-in
Sharing details with a partner	Consent	Unticked checkbox, name the partner

Notice the pattern. Replying to what someone asked for is legitimate use. Anything beyond that is a separate choice.

What valid consent looks like

When you do need consent, make it a real choice:

• Specific. One box per purpose, never one box for everything.
• Unticked. The person must tick it themselves.
• Optional. The service still works if they say no.
• Clear. Plain words, in a language they understand.
• Reversible. Withdrawing is as easy as agreeing.

Common mistakes

1. Bundling. One box that covers the demo reply, the newsletter and partner sharing.
2. Pre-ticked boxes. A tick the person did not make is not consent.
3. Stretching legitimate use. A demo request lets you reply to the demo request. It does not quietly cover marketing emails.
4. Blocking the service. Do not refuse the basics because someone said no to an optional extra.
5. No record. If you cannot show what the person saw and chose, you cannot prove it.

Keep a record either way

Even when no checkbox is needed, keep a note that the person was shown the notice. Keep that note separate from consent, so you never count a notice as a yes.

How pactbase handles it

In pactbase, each purpose you define is tagged either Consent or Legitimate use.

• Consent purposes get an unticked checkbox on your form, with a "Why we ask" link to your Purpose Registry.
• Legitimate-use purposes show the purpose name and a link to read the notice, with no checkbox.
• The form always submits, ticked or not. pactbase never blocks it.
• The Consent ledger records a Granted or Not granted entry for consent, and a Notice shown entry for legitimate use. A Notice shown entry is never counted as consent.
• Withdrawing later adds a new entry. Nothing is edited or deleted.

Start free or book a demo to set up your own purposes.

Frequently asked questions

What is legitimate use in DPDP?

It is when a person voluntarily gives you their data for a specific purpose, and you use it only for that purpose after showing them a notice.

Do I need a checkbox for a demo request?

Not for replying to the demo request itself. You do need a separate, unticked checkbox for anything extra, like a newsletter.

Can I use legitimate use for marketing emails?

Treat marketing as its own purpose and ask for consent with an unticked box.

What if someone refuses an optional consent?

The service must still work. Optional purposes should never block the basics.

Can people withdraw consent later?

Yes, and it should be as easy as agreeing. In pactbase, a withdrawal is a new entry in the ledger.