s.2 · s.5 · s.6 · s.8 · Rule 8
Specified purpose
The specified purpose is the purpose stated in the notice given to the Data Principal, and it is the boundary of what the personal data may be used for.
Consent under Section 6(1) is limited to the personal data necessary for the specified purpose. Section 8(7) requires erasure once the purpose is no longer being served. The purpose therefore does three jobs: it defines what may be collected, what it may be used for, and how long it may be kept.
Rule 8 adds a clock for large classes of Data Fiduciary and a pre-erasure warning at least forty-eight hours before data is erased for non-use, so a purpose that has lapsed is not quietly extended.
Questions people ask
- Can one notice list several purposes?
- Yes, but consent must be specific to each, and bundling a necessary purpose with an optional one makes the consent conditional, which Section 6(1) prohibits.
- When is a purpose "no longer served"?
- When the Data Principal has not approached the Fiduciary for it and the Fiduciary can reasonably assume it is done; Rule 8 fixes the period for listed classes.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.