DPDP Act 2023 · s. 4 · Ch. IIUpcoming · 13 May 2027

Grounds for processing personal data

Status: Upcoming
Applies from: 13 May 2027G.S.R. 843(E)
Penalty: Up to Rs 50 croreSchedule, item 7
Binds: Every Data Fiduciary

In plain English

Personal data may be processed only for a lawful purpose, and only on one of two grounds: the Data Principal's consent, or one of the certain legitimate uses listed in s. 7. There is no general legitimate-interests ground as there is under GDPR.

What you must do

Map every processing activity to either consent or a listed legitimate use before you rely on it.
Drop or redesign any processing that fits neither ground.

Gazette text · s. 4A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—

(1)
A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—
1. (a)
  for which the Data Principal has given her consent; or
2. (b)
  for certain legitimate uses.
(2)
For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.

Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)

Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); DPDP Act 2023, s. 4 · Change log