Gevox
Start a scan
DPDP reference

Section 4

Grounds for processing personal data

Personal data may be processed for a lawful purpose on one of exactly two grounds: consent, or a listed legitimate use.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1)
A person may process personal data only in accordance with the Act and for a lawful purpose, either where the Data Principal has consented, or for one of the certain legitimate uses.
(2)
A lawful purpose is any purpose not expressly forbidden by law.

In practice

There is no third ground. Anyone carrying a lawful basis register built for the GDPR will find that legitimate interests, contractual necessity and vital interests have no Indian equivalent to map onto. Every processing activity resting on one of those has to be re-housed under consent or under one of s.7’s closed list.

Read next

s.5NoticeEvery consent request must carry, or be preceded by, a notice stating the data, the purpose, how to exercise rights and how to complain to the Board.s.6ConsentSets the standard for valid consent, the right to withdraw it as easily as it was given, and the rule that the Data Fiduciary carries the burden of proving both.s.7Certain legitimate usesThe closed list of situations where personal data may be processed without consent, from voluntary provision to medical emergencies and employment.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 4 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy