Lesson 1.5: Core principles and lawful grounds
The Act is built on a few simple ideas. Learn them and the detailed rules become easy to remember. This DPDPA 2023 course page explains core principles and lawful grounds in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about core principles and lawful grounds
- List the core principles behind the Act
- Explain consent and the legitimate uses
- Know when no consent is needed
The core ideas (core principles and lawful grounds)
Lawful and fair use, a stated purpose, collect only what you need, keep it accurate, keep it secure, delete it when done, and be accountable. The Act turns these into duties for the Data Fiduciary.
Click the ideas
Consent versus legitimate uses (core principles and lawful grounds)
| Ground | When it applies | Example |
|---|---|---|
| Consent | The default for most commercial processing | Newsletter sign-up |
| Voluntary provision | The person voluntarily gave data for a purpose and did not object | Sharing your phone number to receive a delivery |
| State benefits | Government subsidies, benefits, licences | Applying for a government scheme |
| Legal obligation | A law requires the processing | Tax records |
| Medical emergency | Life-threatening situation | Emergency treatment |
| Employment | Purposes related to employment | Payroll and attendance |
| Public order, disasters | Responding to epidemics or disasters | Contact tracing |
Withdrawing consent
It must be as easy to withdraw consent as to give it. Once withdrawn, you must stop processing and tell any processor to stop, unless another law requires you to keep the data. For a hands-on guide, see How to manage consent and withdrawal.
Activity (5 minutes) (core principles and lawful grounds)
Pick one data collection form in your business. Check it against the four words: free, specific, informed, unambiguous. Note what is missing.
Check your understanding of core principles and lawful grounds
Q1. Which is the default ground for most commercial processing?
Q2. Can a person withdraw consent as easily as they gave it?
Q3. Which is a legitimate use that needs no consent?
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.