---
title: "Section 4: Grounds for processing personal data"
url: https://dpdp.myndsolution.com/wiki/act/section-4-grounds-for-processing-personal-data/
description: "Section 4 of the Digital Personal Data Protection Act, 2023 (Grounds for processing personal data). Official text verbatim, comes into force on 13 may 2027…"
kind: act-section
updated: 2026-09-09
official_source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
text_type: official-text-plus-interpretation
publisher: MYND Integrated Solutions
license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions.
disclaimer: Not legal advice. Official text prevails over any interpretation.
html_version: https://dpdp.myndsolution.com/wiki/act/section-4-grounds-for-processing-personal-data/
---
# Section 4: Grounds for processing personal data

*The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Chapter II: OBLIGATIONS OF DATA FIDUCIARY. Comes into force on 13 May 2027.*

## Official text

- **(1)** A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—
  - **(a)** for which the Data Principal has given her consent; or
  - **(b)** for certain legitimate uses.

- **(2)** For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.



## Interpretation in plain English (not legal advice)

> This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation.

Section 4 establishes the fundamental rules for when any person or organization can process personal data under the Act. It states that the personal data of a Data Principal, which is the individual to whom the data relates, can only be processed if the processing complies with the provisions of the Act. Furthermore, the processing must always be for a lawful purpose. The section limits the processing of personal data to two specific grounds. First, data can be processed if the Data Principal has explicitly given their consent for that processing. Second, data can be processed for certain legitimate uses. These legitimate uses are specific scenarios recognized by the Act where obtaining consent is not necessary. Finally, the section provides a clear definition of what constitutes a lawful purpose. It states that a lawful purpose is any purpose that is not expressly forbidden by law. This means that as long as the reason for collecting and using the personal data is not illegal or prohibited by other legislation, it meets this requirement.

### Key points

- Personal data can only be processed in accordance with the Act and for a lawful purpose [(1)].
- Processing is permitted if the Data Principal has given their consent [(1)(a)].
- Processing is also permitted for certain legitimate uses [(1)(b)].
- A lawful purpose is defined as any purpose that is not expressly forbidden by law [(2)].

### Common misreadings

- One might think a lawful purpose requires a specific law authorizing the processing, but the Act clarifies it simply means the purpose must not be expressly forbidden by law.

*Interpretation prepared 2026-09-09 from the official text only; the official text prevails.*

---
Cite as: Digital Personal Data Protection Act, 2023, s. 4. Official source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf