Can companies use your data without consent?
When data can be used without consent in India: the limited legitimate uses under DPDP, what still needs your permission, and how to tell the difference.
The simple answer
Consent is central to DPDP, but the law also recognises certain limited situations, sometimes called legitimate uses, where data can be processed without fresh consent, such as for a service you voluntarily asked for or specific legal duties.
This is narrower than it sounds. It does not give companies a free pass to do anything; the use still has to fit a recognised, limited purpose.
What to check
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
Consent is the rule, not the only door.
State of Privacy reads policies closely because companies sometimes stretch limited bases to cover broad uses. The basis for a use should be specific and honest.
What to do next
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
People also ask
Can my data be used without consent?
Only in limited, recognised situations under DPDP; most uses, especially marketing, still need your consent.
What are legitimate uses?
Specific, limited cases such as a service you asked for or certain legal duties, not a blanket permission.
How do I check?
Ask the company for the exact basis of a use and be wary of broad necessity claims.
How many trackers run on your pages? Does your privacy policy name them? Can you answer a data-rights email? If you don't know, we can help you find out.
Talk to Meridian Bridge Strategy →Your personal data belongs to you. Under DPDP, every company must tell you what they have and delete it if you ask. One email is all it takes.
Get the template email →We investigated 107 Indian company websites. The public report shows what we found.