Specified Purpose
The purpose stated in the notice and for which the Data Principal gave consent.
The specified purpose is the reason you told the person for collecting her data. The data may be used for that reason and nothing else without a fresh notice and consent.
Meaning of Specified Purpose
A Data Fiduciary may process personal data only for the purpose the Data Principal was told about and agreed to, or for a listed legitimate use. Using data for a different purpose needs a fresh notice and consent.
Section 2 defines "specified purpose" as the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the Act. The definition is tied to the notice. A purpose that was never written in a notice, or was buried in an unrelated document, is not specified in the legal sense, and consent cannot attach to it.
The term then runs through the Act. Section 6(1) says consent must signify agreement to processing of only that personal data which is necessary for the specified purpose. Section 7(a) lets a fiduciary process data voluntarily provided for the specified purpose, if the person has not indicated that she does not consent. Section 8(7) requires erasure once the specified purpose is no longer being served, and Section 8(8) explains when it is treated as no longer served for prescribed classes.
In practice the purpose has to be precise enough that an ordinary person can tell what will happen to her data. "To deliver your order and send delivery updates" works. "For business purposes" or "to improve user experience" does not tell her anything. Rule 3 asks for an itemised description of the data and the specific purpose along with a description of the goods or services enabled by that processing.
Purpose differs from legal ground. The ground (consent or a legitimate use) answers why processing is permitted, while the purpose answers what it is for. It also differs from the "purpose limitation" principle, which is the rule that data collected for one purpose should not be quietly used for another. The Act has no general "compatible purpose" or legitimate-interest test, so a new use usually needs a new notice and consent.
Examples of Specified Purpose
A person gives a phone number for delivery updates. Using the same number for promotional calls is a different purpose and needs separate consent.
A store collects mobile numbers for order updates. The marketing team wants to send festival offers to the same list, so the store adds a separate, optional marketing purpose with its own consent instead of using the delivery consent.
A lending app collects bank statements to assess a loan application. It deletes them after the decision and does not reuse them to design insurance cross-sell offers, because that purpose was never stated.
A school gathers parents' phone numbers to send attendance alerts. When the parent-teacher association asks for the list for fund-raising, the school declines, because the data was given for a different purpose.
Why Specified Purpose matters
Purpose drives almost every other duty: what data you may collect, how long you may keep it, whom you may share it with and when you must delete it. A vague purpose weakens all of these at once. If a Board inquiry asks why a particular field was collected, the answer must be found in the notice. The burden of proving that notice and consent were valid lies on the fiduciary under Section 6(10).
Using data outside the specified purpose is a typical way of falling into the general penalty of up to ₹50 crore, and can turn into larger exposure if the new use also involves weak safeguards. It also damages trust. People tolerate a delivery app using their phone number for delivery; they complain when the same number appears in a promotional campaign.
How it works in practice
- 1Write the purpose first, then the data. For every field on a form, ask which stated purpose needs it. If the answer is none, remove the field.
- 2Keep each purpose separate in the notice and consent flow, so that a person can agree to order delivery without being forced to accept marketing. Bundled purposes are open to challenge as not specific.
- 3Maintain a purpose register that links each purpose to the data fields, systems, processors and retention period. Check this register before any new campaign, analytics project or model-training use.
- 4When a new use appears, such as cross-selling or fraud analytics, decide whether it falls within the existing purpose. If it does not, issue a fresh notice and obtain consent unless a Section 7 ground clearly applies.
- 5Set a deletion trigger for every purpose. When the purpose ends, erase the data and ask processors to do the same.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Writing a catch-all purpose such as "any lawful business purpose". Purposes must be specific enough for informed consent.
Assuming a related use is allowed. The Act has no compatible-use clause, so test every new use against the notice.
Keeping data after the purpose ends "just in case". Section 8(7) requires erasure unless a law requires retention.
Describing purposes only in a [privacy policy](term/privacy-policy). Under Rule 3 the notice must stand on its own.
Compliance tips
Review all existing consent texts and rewrite vague purposes before the main obligations apply on 13 May 2027.
Give product managers a one-page rule: no new use of customer data without a purpose-register check.
Tag datasets in your warehouse with their specified purpose so analysts know what they may and may not do.
Use separate toggles for optional purposes such as personalised offers, and make withdrawal as easy as giving consent.
Common questions about Specified Purpose
What is a specified purpose under the DPDP Act?
It is the purpose stated in the notice given to the Data Principal. Consent and many legitimate uses relate to that purpose, and the fiduciary may process only the data necessary for it. A purpose not stated in the notice is not a specified purpose.
Can I use data for a new purpose later?
Generally you need a fresh notice and consent for a new purpose, unless a Section 7 legitimate use clearly applies. The Act has no general legitimate-interest ground, so commercial convenience alone is not enough to justify a change.
Is specified purpose the same as purpose limitation?
They are linked. Specified purpose is the Act's defined term for the stated reason, while purpose limitation is the broader principle that data should be used only for that reason. The Act builds the principle through consent, notice and erasure rules.
How specific must the purpose be?
Specific enough that an ordinary person can understand what will be done and why, as Rule 3 asks for itemised data and a specific purpose. Phrases such as "improving services" or "business needs" are unlikely to be enough on their own.