DPDP Act 2023, s.4: consent or a certain legitimate use are the only grounds (Digital Personal Data Protection Act, 2023 (22 of 2023), s.4(1))
India has no legitimate-interest or business-improvement ground. Once the Act is fully in force (about May 2027), a holder may use customer or staff personal data only with the person's consent or for one of the listed legitimate uses in s.7.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,- (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses.”
Where it was read
Also read from the same source
- DPDP Act 2023, s.16: transfers abroad are allowed unless the government restricts a country (Digital Personal Data Protection Act, 2023 (22 of 2023), s.16)
- DPDP Act 2023, s.2(t): personal data means data about an identifiable individual (Digital Personal Data Protection Act, 2023 (22 of 2023), s.2(t))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide