India DPDPA: Article 4 – Grounds for processing digital personal data
4. Grounds for processing digital personal data
(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—
(a) for which the Data Principal has given her consent; or
(b) for certain legitimate uses.
(2) For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.
What Article 4 Means for Your Business
Article 4 establishes that personal data may only be processed for a lawful purpose, either with the consent of the Data Principal, or for certain legitimate uses specified in Article 7. Unlike the GDPR’s six legal bases, the DPDPA uses a narrower framework built primarily around consent, making it one of the most consent-centric data protection laws in the world.
- Before processing any personal data, your business must have either a valid consent from the individual or a recognised legitimate use under Article 7, there is no general “legitimate interests” ground as exists under GDPR.
- Data must only be processed for the specific purpose for which consent was obtained, purpose limitation is strictly enforced.
- Personal data must be accurate and kept only for as long as necessary to fulfil the stated purpose.
- Data Fiduciaries must implement reasonable security safeguards to protect data at all stages of processing.
- Map all data processing activities in your organisation against these grounds before the Act’s enforcement provisions become active.