Two grounds and a lawful purpose
Section 4 allows processing only for a lawful purpose, and only on one of two grounds. Either the Data Principal has given consent, or the processing is one of the 'certain legitimate uses' in section 7. A lawful purpose is any purpose not expressly forbidden by law.
Sources: Act s.4
What consent must look like
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. It covers only the specified purpose and only the data needed for it. Lesson 5 covers consent in depth, including withdrawal and proof.
Sources: Act s.6(1)
The nine legitimate uses
Section 7 lists nine uses that need no fresh consent. The first is where a person voluntarily gives data for a specified purpose and has not said she objects to its use. The Act's example: a shopper gives a pharmacy her number to receive a payment receipt by message.
Three others concern the State: subsidies, benefits, licences and permits; State functions under law or for sovereignty and security; and legal duties to disclose information to the State. The rest cover complying with judgments or orders, medical emergencies, epidemics and public health threats, disasters or breakdown of public order, and employment.
Sources: Act s.7
Employment as a legitimate use
Employers may process data for employment purposes, or to safeguard themselves from loss or liability, for example preventing corporate espionage or protecting trade secrets, intellectual property and classified information. It also covers providing a service or benefit that an employee asks for.
Sources: Act s.7(i)
Choosing and recording the ground
The rights to access, correction and erasure apply where the person gave consent, including under section 7(a). So the ground you choose affects what you owe later. Where consent is the ground and it is questioned, the Fiduciary must prove that notice and consent were given.
Sources: Act s.11(1)Act s.12(1)Act s.6(10)
Key points
- Only two grounds exist: consent or a section 7 legitimate use.
- A lawful purpose is one not expressly forbidden by law.
- Section 7 lists nine specific legitimate uses.
- Employment purposes are a listed legitimate use.
- If consent is challenged, the Fiduciary must prove it.
In practice
A checklist for your organisation.
- Map each processing purpose to consent or a named section 7 clause.
- Record the chosen ground in your record of processing activities.
- Keep evidence of every notice shown and every consent given.
- Review employee data uses against the wording of section 7(i).
Check what you learned
5 questions. Choose an answer to see why it is right.
0 of 5 answered
Question 1 of 5
How many grounds for processing does section 4 allow?
Show the answer
A. Two: consent or certain legitimate uses
Section 4(1) allows processing for a lawful purpose for which the person has given consent, or for certain legitimate uses.
Act s.4(1)Section 4(1) allows processing for a lawful purpose for which the person has given consent, or for certain legitimate uses.
Act s.4(1)Question 2 of 5
What is a 'lawful purpose' under the Act?
Show the answer
D. Any purpose not expressly forbidden by law
Section 4(2) defines a lawful purpose as any purpose which is not expressly forbidden by law.
Act s.4(2)Section 4(2) defines a lawful purpose as any purpose which is not expressly forbidden by law.
Act s.4(2)Question 3 of 5
A shopper gives a pharmacy her mobile number and asks for a receipt by message. What lets the pharmacy use it?
Show the answer
B. The legitimate use for data voluntarily provided for a specified purpose
Section 7(a) and its first illustration cover data a person voluntarily provides for a specified purpose, such as a pharmacy sending a payment receipt.
Act s.7(a)Section 7(a) and its first illustration cover data a person voluntarily provides for a specified purpose, such as a pharmacy sending a payment receipt.
Act s.7(a)Question 4 of 5
Which of these is a legitimate use listed in section 7?
Show the answer
C. Responding to a medical emergency involving a threat to life
Section 7(f) covers responding to a medical emergency involving a threat to the life or immediate threat to the health of any individual.
Act s.7(f)Section 7(f) covers responding to a medical emergency involving a threat to the life or immediate threat to the health of any individual.
Act s.7(f)Question 5 of 5
Consent is questioned in a Board proceeding. Who must prove that notice and consent were given?
Show the answer
D. The Data Fiduciary
Section 6(10) obliges the Data Fiduciary to prove that a notice was given and consent was given in line with the Act and Rules.
Act s.6(10)Section 6(10) obliges the Data Fiduciary to prove that a notice was given and consent was given in line with the Act and Rules.
Act s.6(10)
Official sources for this lesson
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023
- G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force
A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.