Data protection · Provision

Section 4, DPDP Act 2023 — Grounds for Processing Personal Data

Personal data may be processed only for a lawful purpose upon either informed consent or a listed legitimate use under Section 7. There is no third ground. (Section 4, Digital Personal Data Protection Act, 2023.)

Quick Statutory Answer

Under Section 4 of the Digital Personal Data Protection Act 2023 (DPDP Act), personal data may only be processed for a lawful purpose grounded either in valid consent under Section 6 or an enumerated legitimate use under Section 7. Unlike other international frameworks (like the GDPR), the DPDP Act provides no broad "legitimate interest" ground; any processing outside consent or Section 7 is unlawful and subject to penalties under Section 33.

Check your compliance exposure — free All provisions

What the section does

  • A person may process the personal data of a Data Principal only in accordance with the provisions of this Act, and strictly for a lawful purpose.
  • That purpose must rest on one of two grounds: consent given by the Data Principal under Section 6, or one of the legitimate uses listed in Section 7. There is no third ground.
  • A lawful purpose means any purpose that is not expressly forbidden by law. Lawfulness is the floor, not the legal authorisation — a purpose can be perfectly lawful and still have no basis under the Act if neither consent nor Section 7 applies.
  • The section governs the processing, not the business: it applies uniformly to micro-startups, sole proprietorships, and multinational conglomerates alike.

Section 4 DPDP Act: Lawful Processing Grounds vs Common Misconceptions

Section 4 DPDP Act: Lawful Processing Grounds vs Common Misconceptions
Processing Ground Statutory Basis Scope & Requirements Validity in India
Informed Consent Section 6 DPDP Act Free, specific, informed, unconditional & unambiguous Primary lawful basis
Legitimate Uses Section 7 DPDP Act Exhaustive list (employment, legal obligation, medical) Permitted without consent
Commercial Legitimate Interest Not in DPDP Act Common in GDPR, omitted from Indian statute Invalid & Unlawful in India
Unilateral Privacy Policy Clause Contractual only Merely informing user does not constitute legal ground Insufficient by itself

Processing with no ground

Unlawful processing. There is no general "legitimate interest" basis. If neither consent nor Section 7 covers processing, it is an actionable breach of the Act.

Where people go wrong

  • Assuming a "legitimate interest" ground exists in India. Section 4 offers only consent or Section 7 legitimate uses.
  • Relying solely on "lawful purpose". Lawfulness alone does not authorise collection without consent or Section 7.
  • Collecting data first and finding a ground later. The ground must exist at the moment of collection.

Common questions

What are the only two grounds for processing data under Section 4?

Under Section 4 of the DPDP Act 2023, personal data may only be processed on the basis of: (1) consent given by the Data Principal under Section 6, or (2) certain legitimate uses specified in Section 7.

Does the DPDP Act allow processing for "legitimate interest"?

No. The DPDP Act does not contain a broad "legitimate interest" ground like the European GDPR. It contains an exhaustive list of specific "legitimate uses" under Section 7.

Act on this

  • Section 7 — legitimate uses list
  • Section 6 — valid consent requirements
  • Free DPDP compliance check

Other provisions

  • Section 7, Digital Personal Data Protection Act
  • Section 3, Digital Personal Data Protection Act
  • Section 9, Digital Personal Data Protection Act
  • Section 2, Digital Personal Data Protection Act
  • Section 10, Digital Personal Data Protection Act
  • Section 33, Digital Personal Data Protection Act

Maintained by the VidhiSar Legal Team

Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.

About this summary

A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.