Section 4 Digital Personal Data Protection Act 2023 - Grounds for Processing Personal Data
Section 4 of the Digital Personal Data Protection Act, 2023 lays down the basic legal gateway for processing personal data. A person's personal data may be processed only in accordance with the Act, for a lawful purpose, and on one of the two statutory grounds identified by Section 4: consent of the Data Principal or a certain legitimate use recognised by the Act.
What Section 4 provides
Section 4(1): Personal data of a Data Principal may be processed only in accordance with the DPDP Act and for a lawful purpose where the Data Principal has given consent, or where the processing falls within the "certain legitimate uses" contemplated by the Act.
Section 4(2): For this provision, a "lawful purpose" is a purpose that is not expressly forbidden by law.
Meaning of important terms
Personal data: Section 2 defines this as data about an individual who is identifiable by or in relation to such data. Processing: broadly covers wholly or partly automated operations performed on digital personal data, including collection, recording, organisation, storage, use, sharing, disclosure, erasure or destruction. Data Principal: is the individual to whom the personal data relates, subject to the statutory treatment of children and persons with disability. Data Fiduciary: is the person who, alone or with others, determines the purpose and means of processing personal data.
Two statutory grounds under Section 4
1. Consent of the Data Principal
Where processing is based on consent, Section 6 governs the quality and operation of that consent. The Act requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to personal data necessary for the specified purpose. Section 5 separately deals with notice to the Data Principal.
2. Certain legitimate uses
Processing may also take place without relying on consent when it falls within a "certain legitimate use" specified in Section 7. These are statutory situations and should not be treated as a general business-interest exception. The applicable clause of Section 7 should be identified before relying on this ground.
How Section 4 works with the rest of the Act
Section 4 is the threshold provision, but it does not operate alone. A Data Fiduciary must also consider the notice and consent requirements in Sections 5 and 6, the specific legitimate uses in Section 7, the general obligations in Section 8, special safeguards for children in Section 9, and other applicable provisions of the Act and rules.
Practical compliance point
Before processing digital personal data, identify the purpose, confirm that the purpose is lawful, identify whether the legal ground is valid consent or a specific legitimate use under Section 7, and then comply with the additional obligations that apply to that processing. Section 4 does not itself create an unrestricted permission to process personal data merely because the purpose is commercially useful or convenient.
Official legal resources
For authoritative text and current notifications, refer to India Code - Digital Personal Data Protection Act, 2023 and the Ministry of Electronics and Information Technology - Acts and Policies.