# Section 4 DPDP Act 2023: Grounds for processing personal data

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/act/section-4/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

**CHAPTER II: OBLIGATIONS OF DATA FIDUCIARY.** The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), section 4. Verbatim from the Gazette of India.

Summary (maintainers', not statutory text): Only consent or s.7 legitimate uses; lawful purpose = not expressly forbidden by law

## Section 4. Grounds for processing personal data

(1) A person may process the personal data of a Data Principal only in accordance with the
provisions of this Act and for a lawful purpose,—
  (a) for which the Data Principal has given her consent; or
  (b) for certain legitimate uses.

(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is
not expressly forbidden by law.