Section 4Grounds for processing personal data

The text of Section 4 of the Digital Personal Data Protection Act, 2023, as published in the Gazette of India, Extraordinary, Part II — Section 1, under the chapter on obligations of data fiduciary.

Bare Act

Section 4 as published in the Gazette of India

(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—

(a) for which the Data Principal has given her consent; or

(b) for certain legitimate uses.

(2) For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.

Source. Digital Personal Data Protection Act, 2023 (Act 22 of 2023, assented 11 August 2023), published in the Gazette of India, Extraordinary, Part II — Section 1. Reproduced verbatim. This page is a reference, not legal advice, and no advisor–client relationship arises from reading it.

All sections, rules and schedules

Need to know what this means for your organisation?

Score your readiness Talk to a practitioner

The authoritative text is the one published in the Gazette of India.