Section 4 — Grounds for

Act 22 of 2023 (DPDP Act 2023) G.S.R. 843(E) In force 13 May 2027 · G.S.R. 843(E) Penalty cap ₹50 cr

Grounds for 4. (1) A person may process the personal data of a Data Principal only in accordance processing with the provisions of this Act and for a lawful purpose,— personal data.

(a) for which the Data Principal has given her consent; or

(b) for certain legitimate uses.

(2) For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.

Verbatim from the gazette. Cross-references in the text link to the section or rule they cite. Corrigendum G.S.R. 892(E) makes no change to this text.