A person may process the personal data of a Data Principal only in accordance with the provisions of this Act, and only for a lawful purpose.
That purpose must rest on one of two grounds: consent given by the Data Principal, or one of the legitimate uses listed in section 7. There is no third ground.
A lawful purpose means any purpose that is not expressly forbidden by law. Lawfulness is the floor, not the authorisation — a purpose can be perfectly lawful and still have no ground to stand on under this section.
The section governs the processing, not the business. It applies the same way to a company of four people and a company of four thousand.
Processing with no ground
a breach of the Act. There is no legitimate-interest ground of the kind found in other regimes. If neither consent nor section 7 covers the processing, it has no basis.
Where people go wrong
Assuming a legitimate-interest ground exists because other data protection regimes have one. Section 4 offers consent or section 7, and section 7 is a closed list.
Reading lawful purpose as sufficient by itself. It qualifies the purpose; it does not supply the ground.
Collecting first and deciding the ground later. The ground has to exist at the time of processing, which is what the notice under section 5 is built around.
Believing a privacy policy creates a ground. Publishing a policy is not the same as obtaining consent or falling within a legitimate use.
Common questions
What are the lawful grounds for processing personal data under the DPDP Act?
Section 4 permits processing for a lawful purpose on one of two grounds: the consent of the Data Principal, or one of the legitimate uses set out in section 7. The Act does not provide any other basis.
Does the DPDP Act have a legitimate interest ground?
No. It has legitimate uses, which is a different thing. Section 7 lists them specifically, and a use that is not on that list cannot be reached by arguing that the business has an interest in it.
What counts as a lawful purpose?
Any purpose not expressly forbidden by law. It is a threshold the purpose must clear, after which processing still needs consent or a section 7 legitimate use to proceed.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.