DPDP reference
Section 4: Grounds for processing personal data
Last checked 6 Nov 2026
Personal data may be processed only for a lawful purpose and on one of two grounds: the Data Principal's consent, or one of the certain legitimate uses in s.7 (s.4(1)). A lawful purpose is any purpose not expressly forbidden by law (s.4(2)).
- Applies to
- Every Data Fiduciary, of any size, unless an exemption in s.17 applies.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- Up to ₹50 crore (s.33, Schedule item 7).
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 4; G.S.R. 843(E), commencement
Questions
Does the DPDP Act have a legitimate interests ground?
The Act gives two grounds: consent, and the certain legitimate uses listed in s.7 (s.4(1)). A use outside that list needs consent.
Related
Next
Not legal advice.