Can companies process my data for research without consent?

What the Law Says

The Digital Personal Data Protection Act, 2023 permits processing of personal data for research purposes without individual consent — but only under strict conditions.

Under Section 7(1)(a) of the Digital Personal Data Protection Act, 2023, a data fiduciary may process personal data without consent if it is for 'purposes of research, archiving, or statistical purposes', provided the data is anonymised and the processing does not harm the rights of the data principal.

The Act defines 'anonymisation' as irreversible removal of identifiers so that individuals cannot be identified — and mandates that anonymised data must not be re-identifiable. Any processing of non-anonymised personal data for research still requires valid consent or another lawful basis.

Importantly, this exemption applies only to processing by entities registered in India or operating in India, and does not override other obligations like data security, accountability, or grievance redressal.

Statutory Text

processing of personal data is necessary for the purpose of research, archiving or statistical purposes, provided that such processing is carried out in a manner which does not cause harm to the rights of the data principal and the personal data is anonymised

— Digital Personal Data Protection Act, 2023, s. 7(1)(a) — Processing for research, archiving or statistical purposes

Sources