Compliance
The DPDP Act allows processing only on consent or a listed legitimate use; failing to secure one of these grounds can trigger a breach penalty, costing businesses both fines and reputational damage.
Check your DPDP readiness — free More on the blogThe first task is to decide why the personal data is needed. The purpose must not be expressly forbidden by any law. This decision is made by senior management, often the chief compliance officer, and recorded in a purpose‑statement document. The statement is the baseline against which the two allowed grounds – consent or a listed legitimate use – will be matched. Without this clear purpose, no further step can be justified under the Act.
Section 7 contains a closed list of legitimate uses. The compliance team compares the purpose‑statement with each item on that list. If a match is found, the team writes a justification note citing the specific clause from Section 7, the business need, and the data categories involved. This note becomes part of the data‑processing register and must be kept for audit. If no match exists, the business must move to the consent route.
When the purpose falls outside the Section 7 list, the next step is to secure explicit consent from each Data Principal. The marketing or sales head drafts a consent form that meets the Act’s clarity requirements, explains the purpose, and offers a simple opt‑in mechanism. The form is signed or electronically recorded, and a copy is stored in the customer file. The consent record must be retrievable for the entire retention period.
Regardless of the ground chosen, the business must produce a Section 5 notice that tells the Data Principal the purpose, the ground (consent or specific legitimate use), and their rights. The legal or compliance officer drafts this notice, aligns it with the purpose‑statement or consent record, and uploads it to the website or app. A dated copy is saved in the compliance folder alongside the processing register.
The chief compliance officer owns the overall process, but day‑to‑day tasks are delegated: data owners verify the purpose, IT ensures consent logs are stored securely, and the legal team reviews the notice for accuracy. Roles and responsibilities are captured in an internal policy, signed by department heads, and filed with the compliance documentation.
If the Data Protection Board or a Data Principal asks for proof, the business must produce the purpose‑statement, the ground justification, the consent record or Section 7 reference, and the notice copy. All these items should be indexed in the processing register so they can be retrieved quickly. Failure to produce any of them is treated as a breach and can attract the statutory penalty.
The compliance calendar includes an annual audit of each processing activity. The audit checks that the purpose remains lawful, the ground still applies, and consent has not been withdrawn. Any change triggers a fresh purpose check and, if needed, a new consent request. The audit report is signed by the chief compliance officer and stored with the register for future inspection.
Compare your purpose with each item listed in Section 7. If the description aligns, note the exact clause, write a brief justification linking the business need to that clause, and store it in the processing register. Only a direct match counts; a loose similarity does not satisfy the requirement.
A valid consent form must clearly state the purpose of processing, be presented in plain language, offer a simple opt‑in mechanism, and be signed or electronically recorded by the Data Principal. The form must also indicate that consent can be withdrawn at any time.
No. Publishing a privacy policy does not create a legal ground for processing. Consent must be obtained separately, and the policy merely informs the Data Principal about the purpose and their rights.
You need a purpose‑statement, the specific Section 7 clause you are relying on, a justification note linking the two, the Section 5 notice issued to the Data Principal, and an entry in the processing register. These documents must be retained for the entire data retention period.
Published 21 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.