Law.asia Analysis Outlines DPDP Act Scope Over Legacy Data and Section 7 Exemptions

What happened

Shantanu Sahay, Partner at Anand and Anand, published a legal analysis via Law.asia detailing how the Digital Personal Data Protection Act, 2023 applies to legacy data. The report clarified that the statutory framework applies to ongoing processing activities rather than acting retroactively on completed tasks. Most main processing obligations are scheduled to take effect in May 2027.

The analysis noted that the Act does not create a separate statutory category for legacy data. Section 5(2) allows organizations to continue using existing databases where prior consent exists. This provision does not exempt historical data from the broader compliance requirements of the new framework.

Does the DPDP Act apply here?

The DPDP Act covers digital personal data processed within India. Section 3 states the Act applies to data collected in digital form or digitized subsequently. Since the legal definition of processing includes the storage and retention of data, dormant databases remain fully in scope.

A bank or insurer holding millions of historical records on legacy systems is actively processing that data simply by storing it. If the data relates to Data Principals in India, the organization must comply with the DPDP Rules, 2025. The framework demands a lawful basis for every retained record.

Legal implications under DPDP

Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Under Section 4, a person may process personal data only for a lawful purpose. Section 5 requires data fiduciaries to send an itemised notice to Data Principals who gave consent before the Act commenced.

The Law.asia analysis detailed that Section 7 provides specific conditions for processing without consent. These cover qualifying employment-related uses and specific instances of voluntary information provision. Businesses cannot interpret Section 7 as a broad commercial interest exception to mine old datasets for new product cross-selling.

Could this happen to you

A Chief Compliance Officer at a large financial institution often inherits fragmented core banking systems and decades of old customer data. If the Data Protection Board of India initiates an inquiry, investigators will ask for the Record of Processing Activities mapping these old stores. You need to produce an audit-ready consent artefact or a documented Section 7 justification for each dataset.

Operating without an evidence trail exposes the business to regulatory action. The Act establishes penalty ceilings up to 250 crore rupees for failing to fulfill data fiduciary obligations. A manual spreadsheet approach fails when auditors demand proof that an itemised notice reached a specific customer regarding a ten-year-old account.

What companies should do in the next 30 days

1. The data office must map all existing databases containing personal data across legacy and active systems.

2. Compliance teams need to assign a lawful basis to each dataset, distinguishing between prior consent and Section 7 uses.

3. Legal counsel should draft the itemised notice required for Section 5 compliance.

4. IT leaders must deploy a system capable of logging notice delivery and capturing any subsequent consent withdrawals.

What to watch

181 days remain until the 13 May 2027 hard deadline. The Central Government will continue to operationalize the DPDP Rules, 2025, which specify the exact format and delivery mechanisms for legacy data notices. Organizations should watch for the formal establishment of the Data Protection Board of India and its early procedural guidelines.

Check your team readiness to handle legacy data notices and evidence trails by running a secure self-assessment at https://www.complydp.com/audit-preview.