Section 7 Certain legitimate uses
7. A Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data may process personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf for any of following uses, namely:-
(a) for the specified purpose for which the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf has voluntarily provided her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data, and in respect of which sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has not indicated to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data that sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender does not consent to the use of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
Illustration
(I) X, an individual, makes a purchase at Y, a pharmacy. SheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender voluntarily provides Y her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and requests Y to acknowledge receipt of the payment made for the purchase by sending a message to her mobile phone. Y may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X for the purpose of sending the receipt.
(II) X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for this purpose. Y may process her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X;
(b) for the State and any of its instrumentalities to provide or issue to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf such subsidy, benefit, service, certificate, licence or permit as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act, where-
(i) sheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender has previously consented to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by the State or any of its instrumentalities for any subsidy, benefit, service, certificate, licence or permit; or
(ii) such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data is available in digital form in, or in non-digital form and digitised subsequently from, any database, register, book or other document which is maintained by the State or any of its instrumentalities and is notified by the Central Government,
subject to standards followed for processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... being in accordance with the policy issued by the Central Government or any law for the time being in force for governance of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data.
Illustration
X. a pregnant woman, enrols herself on an app or website to avail of government's maternity benefits programme, while consenting to provide her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for the purpose of availing of such benefits. Government may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of X processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... to determine her eligibility to receive any other prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act benefit from the government;
(c) for the performance by the State or any of its instrumentalities of any function under any law for the time being in force in India or in the interest of sovereignty and integrity of India or security of the State;
(d) for fulfilling any obligation under any law for the time being in force in India on any personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses to disclose any information to the State or any of its instrumentalities, subject to such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... being in accordance with the provisions regarding disclosure of such information in any other law for the time being in force;
(e) for compliance with any judgment or decree or order issued under any law for the time being in force in India, or any judgment or order relating to claims of a contractual or civil nature under any law for the time being in force outside India;
(f) for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf or any other individual;
(g) for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health;
(h) for taking measures to ensure safety of, or provide assistance or services to, any individual during any disaster, or any breakdown of public order
Explanation.-For the purposes of this clause, the expression "disaster" shall have the same meaning as assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005; or
(i) for the purposes of employment or those related to safeguarding the employer from lossDefined in section 2(p): loss means (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf who is an employee.