Compliance
Section 4 limits data processing to either consent or a listed legitimate use, meaning any other basis is a breach that can cost a small business heavy penalties.
Check your DPDP readiness — free More on the blogThe law governing digital personal data allows processing only when the purpose is lawful and rests on one of two specific grounds. This means a business cannot rely on vague interests or generic policies. The two grounds are explicit consent from the data subject, or a use that appears on a closed list of legitimate purposes. Anything outside these two pillars lacks legal support and exposes the business to non‑compliance consequences.
A lawful purpose is simply one that is not expressly forbidden by law. This is a minimum requirement, not a full justification. Even if a purpose passes this test, the processing still needs either consent or a listed legitimate use. In practice, businesses must first check that their activity is not prohibited, then confirm that one of the two recognised grounds applies before proceeding with any data handling.
Consent must be obtained from the data principal before any processing takes place. It is not enough to mention consent in a privacy policy; the actual agreement must be secured at the time of processing. The notice required under the law is built around this ground, ensuring that the data subject is aware of what is being done with their information and has actively agreed to it.
The second ground is a set of legitimate uses that are specifically listed. This list is closed, meaning that only the purposes enumerated can be relied upon. Businesses cannot stretch the definition or claim a new interest that is not on the list. If a use is not on the list, it cannot be justified as a legitimate use, even if it seems reasonable from a commercial perspective. Common mistakes arise from confusing the concept of legitimate interest with the listed legitimate uses. Many data protection regimes elsewhere include a broader interest ground, but this law does not. Relying on an assumed interest that is not on the list leaves the processing without a legal basis, turning a routine activity into a breach. Another frequent error is treating the lawful purpose test as sufficient. While a purpose must be lawful, that alone does not satisfy the requirement for a ground. The lawful purpose filter simply removes prohibited activities; it does not replace the need for consent or a listed legitimate use. Collecting data first and deciding on the legal ground later is also risky. The ground must exist at the moment of processing, which is why the notice under the law is tied to the chosen ground. Delaying the decision can result in processing without a valid basis, exposing the business to enforcement action. Publishing a privacy policy does not create a processing ground. A policy explains how data will be handled, but it does not substitute for the actual consent of the data subject or a legitimate use from the list. Businesses must treat the policy as an informational tool, not a legal shield. If processing occurs without either consent or a listed legitimate use, the activity is a breach. The law does not provide a catch‑all interest ground, so any processing outside the two permitted bases is unlawful. This can lead to penalties, reputational damage, and the need to halt the activity until a proper ground is established.
Processing is permitted only when the purpose is lawful and rests on either the data subject's consent or a legitimate use that appears on the specific list provided by the law.
No. The law offers a closed list of legitimate uses, not a broad legitimate‑interest ground. Any purpose not on that list cannot be justified as a legitimate use.
No. A privacy policy merely informs data subjects; it does not constitute consent nor does it create a legitimate use. The required ground must be obtained separately.
Processing without consent or a listed legitimate use breaches the law, exposing the business to penalties, possible enforcement action, and the need to cease the unlawful activity.
Published 24 September 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.