Section 4: Grounds for Processing Personal Data
Section 4 opens Chapter II with the Act's most fundamental rule: you may only process someone's personal data if you have a lawful basis to do so, and the Act recognises exactly two — the person's consent, or one of the specific “certain legitimate uses” listed in Section 7.
Quick summary
What Section 4 says
- Sub-section (1) — a person may process the personal data of a Data Principal only in accordance with the Act's provisions and for a lawful purpose, either (a) for which the Data Principal has given her consent, or (b) for certain legitimate uses.
- Sub-section (2) — for this section, “lawful purpose” means any purpose that is not expressly forbidden by law.
Breaking it down
Section 4 is short, but it's the gate everything else in Chapter II passes through. Every subsequent obligation — notice, valid consent, security safeguards, breach reporting — assumes you've already cleared this threshold: you need one of exactly two lawful bases before you touch someone's personal data at all.
Consent
Covered in full in Section 6 — must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and accompanied by the notice required under Section 5.
Certain legitimate uses
A closed list of nine specific situations in Section 7 — from data the Data Principal voluntarily provided and didn't object to, to medical emergencies, disasters, and employment-related purposes.
There's no open-ended “legitimate interest” basis the way some other data protection laws allow — if a use doesn't fit consent and doesn't fit one of Section 7's nine listed grounds, it isn't a lawful basis under the Act.
“Lawful purpose” is a low bar, deliberately. Sub-section (2)'s definition — not expressly forbidden by law — is broad. It isn't asking whether processing is a good idea; it's a backstop ruling out purposes that are affirmatively illegal (processing data to facilitate a crime, for instance). The real gatekeeping work in this Act is done by the consent/legitimate-uses requirement in sub-section (1), not by the lawful-purpose test in sub-section (2).
Why this section matters
Section 4 is why a compliance conversation about the DPDP Act almost always starts with the same question: “what's our lawful basis for this?” Unlike some frameworks where an organisation can lean on a broad, flexible justification, the Act gives exactly two doors in: consent, or one of Section 7's specific listed uses. If neither applies, the processing isn't lawful under the Act, however sensible it might seem from a business standpoint.
Real-world example
Trellis Fitness, a gym-chain app tracking workout and biometric data
Trellis's product team wants to use member workout data for three different purposes, and checks Section 4 for each:
- Showing a member their own workout history in the app — covered by the consent the member gave at signup for the specified purpose of using the fitness-tracking service.
- Sharing anonymised, aggregated workout trends with a gym-equipment manufacturer — if the data is genuinely anonymised (no longer “personal data” under Section 2), Section 4 doesn't apply at all; if it's not properly anonymised, Trellis needs a fresh lawful basis for this new purpose — the original signup consent doesn't automatically stretch to cover it.
- Using a member's location data to auto-check them into the nearest gym during an evacuation drill — potentially covered by the medical-emergency/safety-related “certain legitimate use” in Section 7(h), rather than needing fresh consent in the moment.
Who needs to care about this section
- Product and legal teams scoping any new feature — that touches personal data — Section 4 is the first question to answer, before designing the notice or consent flow.
- Anyone tempted to rely on “legitimate interest” — the Act doesn't have that basis; if it's not consent and it's not one of Section 7's nine specific uses, it isn't lawful under the Act.
- Data Fiduciaries expanding an existing dataset's use — a new purpose generally needs its own lawful basis, not a stretch of the original one.
Common questions
Can we process personal data just because our privacy policy says we might?
Is there a "legitimate interest" basis like under the GDPR?
Does "lawful purpose" mean we need a specific law authorising our processing?
Related sections
Section 5 — Notice
Continue to the next section in sequence.
Read Section 5Section 3 — Application of Act
Go back to the previous section.
Read Section 3Chapter II — Obligations of Data Fiduciary
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsConsent Under the DPDP Act
How consent itself works as a lawful basis — what makes it valid, and how it interacts with notice.
Read about consent