Two Grounds. That's All.
Consent, or "certain legitimate uses". There is no third door — no "legitimate interest" balancing test
Read the full guide: Section 4(1) — DPDP Act compliance guide
Watch in English
Summary
There are only two ways to process your data.
Consent, or "certain legitimate uses". There is no third door — no "legitimate interest" balancing test
Full transcript
There are only two ways to process your data.
Section 4 gives the whole list.
Consent that you gave.
Or one of the certain legitimate uses.
Pause. Where is legitimate interest?
It is not in this Act.
There is no balancing test here.
Two grounds, and the Act names both.
Anything else is outside section 4.
Consent, or a legitimate use. That is all.
s.4(1), read with s.7 — Digital Personal Data Protection Act, 2023 + Rules, 2025
In force from 13 May 2027