Section 4Obligations of Data Fiduciary
Grounds for processing of personal data
Official statutory text · Gazette of India
A person may process personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose for which the Data Principal has given her consent, or for certain legitimate uses.
For the purposes of this sub-section, 'lawful purpose' means any purpose which is not expressly forbidden by law.
Plain-language explanation
- DPDP recognises exactly two lawful bases for processing: (1) freely given consent, or (2) one of the specific 'legitimate uses' listed in Section 7 — there is no open-ended 'legitimate interest' ground like in some other privacy laws.
- If your processing doesn't fit consent or a Section 7 legitimate use, it isn't lawful under this Act.
Reconstructed for readability from the publicly notified DPDP Act, 2023. Always verify exact wording against the official Gazette of India before relying on this for legal or compliance decisions.