Section 4 — Grounds for processing personal data

What this section requires

Section 4 is the gate every processing activity has to pass through: personal data may only be processed for a lawful purpose — one not expressly forbidden by law — and only on one of two grounds: the Data Principal's consent, or one of the "certain legitimate uses" listed in Section 7.

There is no third route. If processing isn't grounded in consent or a Section 7 legitimate use, it isn't lawful under this Act, whatever the purpose.

Who it applies to

Every Data Fiduciary, for every processing activity — this is the foundational rule the rest of Chapter II builds on.

Checklist

• For each processing activity, identify which of the two grounds it relies on: Data Principal consent (Section 6), or a specific legitimate use (Section 7).
• Confirm the purpose itself isn't expressly forbidden by any other law — "lawful purpose" is defined by exclusion, not by a positive list.
• Flag any processing that doesn't clearly map to consent or a Section 7 use — these have no lawful basis until they do.

Penalty exposure

No penalty item in the Schedule names Section 4 directly. Processing without a lawful ground under this section is, in substance, a breach "of any other provision of this Act," which the Schedule's residual item 7 catches — a monetary penalty of up to ₹50 crore.

Implementation timeline

Not yet in force. Commences 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (13 November 2025) — per the commencement notification G.S.R. 843(E).