Chapter II: Obligations of Data Fiduciary

Section 4: Grounds for processing personal data

←Sec. 3Sec. 5→

Simple Explanation

Section 4 establishes the two lawful bases for processing personal data: 1. Consent: The Data Principal must give clear, informed consent. 2. Certain Legitimate Uses: Specific scenarios listed in Section 7 where consent is not required (such as government benefits, legal obligations, medical emergencies, etc.). Any processing must be for a lawful purpose, meaning it cannot be for something illegal.

Key Points

  • ✓Two lawful bases for processing: consent or legitimate uses
  • ✓Processing must be for a lawful purpose
  • ✓Consent must be obtained as per Section 6
  • ✓Legitimate uses are defined in Section 7

Official Text (Summary)

A person may process personal data only for a lawful purpose, either with the Data Principal's consent or for certain legitimate uses specified in section 7. Lawful purpose means any purpose not expressly forbidden by law.

Source: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Ministry of Law and Justice.

Jump to any Section

Sec. 1Sec. 2Sec. 3Sec. 4Sec. 5Sec. 6Sec. 7Sec. 8Sec. 9Sec. 10Sec. 11Sec. 12Sec. 13Sec. 14Sec. 15Sec. 16Sec. 17Sec. 18Sec. 19Sec. 20Sec. 21Sec. 22Sec. 23Sec. 24Sec. 25Sec. 26Sec. 27Sec. 28Sec. 29Sec. 30Sec. 31Sec. 32Sec. 33Sec. 34Sec. 35Sec. 36Sec. 37Sec. 38Sec. 39Sec. 40Sec. 41Sec. 42Sec. 43Sec. 44

More Sections in Chapter II

Sec. 4Sec. 5Sec. 6Sec. 7Sec. 8Sec. 9Sec. 10

All Chapters

I. PreliminaryII. Obligations of Data FiduciaryIII. Rights and Duties of Data PrincipalIV. Special ProvisionsV. Data Protection Board of IndiaVI. Powers, Functions and Procedure to be Followed by BoardVII. Appeal and Alternate Dispute ResolutionVIII. Penalties and AdjudicationIX. Miscellaneous

Is your business DPDP compliant?

Avoid penalties up to ₹250 Crore. Let our experts help you implement consent management, grievance redressal, and data protection measures.

Get a Free Compliance Audit