The Digital Personal Data Protection Act, 2023 (Act 22 of 2023). Verbatim text from the Gazette of India.
Section 4 in one line
Only consent or s.7 legitimate uses; lawful purpose = not expressly forbidden by law
Maintainers' summary, not statutory text. The verbatim section follows.
(1) A person may process the personal data of a Data Principal only in accordance with the
provisions of this Act and for a lawful purpose,—
(a) for which the Data Principal has given her consent; or
(b) for certain legitimate uses.
(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is
not expressly forbidden by law.