Statutory Text (Official Gazette)
(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—
- (a) for which the Data Principal has given her consent; or
- (b) for certain legitimate uses.
(2) For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.
What Section 4 Means in Plain English
Section 4 establishes the fundamental legal gate for any data processing in India: no data processing is permitted by default.
To process any personal data legally, your business must establish one of two legal grounds:
- Explicit, Lawful Consent (Section 6): The user affirmatively agreed after receiving an itemised notice. For modern websites, marketing analytics, tracking cookies, and user onboarding, this is the primary legal ground.
- Specific Legitimate Uses (Section 7): Strict, narrow statutory situations where consent is not required (e.g., fulfilling a voluntary request made by the user, government subsidies, medical emergencies, disasters, or employment obligations).
What Does NOT Count as a Ground
Unlike the European GDPR, India’s DPDP Act does not have a broad “legitimate interest” exception for commercial marketing or analytics. You cannot track users across the web claiming commercial interest without direct, affirmative consent.
Engineering Checklist
- Classify your processing grounds: Audit every data pipeline and tag whether it relies on User Consent or a Section 7 Legitimate Use.
- Halt untagged data flows: Any personal data flow without an explicit consent record or statutory exemption creates immediate legal liability.
- Document lawful purposes in your internal registry: Keep an internal record of processing activities linking each database column to its lawful basis.
Check if your website complies with Section 4
Scan your domain in seconds to detect tracking cookies, third-party analytics pixels firing before consent, and missing regional notices.