---
title: "DPDP Act Section 4: Grounds for processing personal data"
description: "Section 4 of the DPDP Act 2023, Grounds for processing personal data: the official text, what it means in plain English and Hindi, and who it affects."
url: "https://dpdpr.in/act/section-4/"
canonical: "https://dpdpr.in/act/section-4/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Section 4. Grounds for processing personal data

DPDP Act, 2023 · Chapter II: Obligations of Data Fiduciary

## In simple words

Personal data can be used only for a lawful purpose. There are only two grounds: the person has given consent, or the use is one of the certain legitimate uses listed in section 7. A lawful purpose is any purpose not expressly forbidden by law.

- **What this means for you**: A company needs your consent, or one of the specific reasons in section 7, to use your data.

- **What this means for businesses**: For each purpose, record whether you rely on consent or on a section 7 legitimate use.

- **Everyday example**: A gym app uses your phone number to send booking reminders because you agreed to it when you signed up.

सरल शब्दों में (हिन्दी अनुवाद)

व्यक्तिगत डेटा का इस्तेमाल केवल किसी वैध उद्देश्य के लिए हो सकता है। इसके केवल दो आधार हैं: व्यक्ति ने सहमति दी हो, या इस्तेमाल धारा 7 में दिए गए कुछ वैध उपयोगों में से एक हो। वैध उद्देश्य वह है जिसे कानून ने स्पष्ट रूप से मना न किया हो।

- **आपके लिए इसका मतलब**: आपका डेटा इस्तेमाल करने के लिए कंपनी को आपकी सहमति चाहिए, या धारा 7 में दिया गया कोई खास कारण।

- **कारोबार के लिए इसका मतलब**: हर उद्देश्य के लिए दर्ज करें कि आप सहमति पर निर्भर हैं या धारा 7 के किसी वैध उपयोग पर।

- **रोज़मर्रा का उदाहरण**: एक जिम ऐप बुकिंग की याद दिलाने के लिए आपका फ़ोन नंबर इस्तेमाल करता है, क्योंकि साइन अप करते समय आपने इसकी सहमति दी थी।

This is our Hindi translation of the plain English summary above, not the official Hindi text of the Act. If they differ, the official text prevails.

## Who it applies to

Every person who processes personal data covered by the Act.

## Related Rules

No specific rule. The text of the Act applies on its own.

### Related sections

- [Section 6. Consent](https://dpdpr.in/act/section-6/)
- [Section 7. Certain legitimate uses](https://dpdpr.in/act/section-7/)

Official text as notified

Source: [MeitY copy of the Gazette (CG-DL-E-12082023-248045), page 4](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf#page=4). Printed dashes are shown as colons; the wording is unchanged.

(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,

(a) for which the Data Principal has given her consent; or

(b) for certain legitimate uses.

(2) For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.

## When this takes effect

- Whole section **Starts 13 May 2027** 191 days to go

Source: [G.S.R. 843(E)](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf) and [rule 1](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf). [All deadlines](https://dpdpr.in/deadlines/)