Legitimate Interest as a Lawful Basis: Pros, Cons and the Indian DPDP Act’s Stance

By Advocate Abhijith Balakrishnan, LL.M, CIPP/E, High Court of Kerala 

In data protection laws worldwide, “legitimate interest” is often recognized as one of the lawful bases allowing organizations to process personal data without consent. Under the EU’s General Data Protection Regulation (GDPR), for example, a company can process data if it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party” (Article 6(1)(f) GDPR), so long as those interests are not overridden by the individual’s rights. However, India’s new Digital Personal Data Protection Act, 2023 (DPDP Act) pointedly does not include legitimate interest as a standalone lawful ground for processing.

Instead, the Indian law relies primarily on consent and a limited set of “legitimate uses” explicitly enumerated in the statute. This divergence raises important questions about the pros and cons of the ...