Section 4, DPDP Act [S10-N1Y]
As at 7 September 2026. Not commenced. Commencement appointed for 13 May 2027 by Notification G.S.R. 843(E): phased commencement of the Digital Personal Data Protection Act, 2023 [N11-6ZG].
4. Grounds for processing personal data.—(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—
(a) for which the Data Principal has given her consent; or
(b) for certain legitimate uses.
(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law.
Defined terms in this text (4)
data: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "data" means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means
data: 5 more definitions.
Data Principal: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "Data Principal" means the individual to whom the personal data relates and, where such individual is a child, includes the parents or lawful guardian, and where a person with disability, includes her lawful guardian acting on her behalf [...]
person: Section 3, General Clauses Act, 1897 [S100SN] (In this Act, and in all Central Acts and Regulations made after the commencement of this Act, unless there is anything repugnant in the subject or context): "person" shall include any company or association or body of individuals, whether incorporated or not
person: 1 more definition.
personal data: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "personal data" means any data about an individual who is identifiable by or in relation to such data
personal data: 3 more definitions.
Made under this section, or naming it (0)
none
Cited by (0)
none
Not held (0)
none
Duties published under this section (0)
none