specified purpose

The Digital Personal Data Protection Act defines "specified purpose" as the exact reason a Data Fiduciary (the entity deciding how and why data is processed) collects and uses a Data Principal's (the individual to whom the data relates) personal data. This reason must be clearly stated in the notice that the Data Fiduciary gives to the Data Principal.\n\nThe definition ties the purpose directly to the formal notice required by the Act and its accompanying rules. This means a purpose is only considered a "specified purpose" if it is actually written down and presented to the individual in that notice, following the procedures set out in the law.\n\nBy defining it this way, the Act ensures that the reasons for processing personal data are transparent and formally communicated. A Data Fiduciary cannot rely on vague or unstated reasons; the purpose must be explicitly mentioned in the notice provided to the Data Principal.

Key points

• The term refers to the specific reason for processing personal data that is mentioned in the formal notice. (2(za))
• The notice containing this purpose must be given by the Data Fiduciary to the Data Principal. (2(za))
• The notice and the purpose mentioned within it must comply with the provisions of the Act and any rules made under it. (2(za))

Common misreadings

• A Data Fiduciary might assume any internal business reason counts as a specified purpose, but it only counts if it is actually mentioned in the notice given to the Data Principal.