Lesson 4.1: Grounds for processing: consent or legitimate use

Module 4 · Lesson 4.1 of 8 · About 30 minutes · Consent or legitimate use

Before you collect anything, name the legal ground. The Act allows only two routes. This DPDPA 2023 course page explains consent or legitimate use in plain language.

consent or legitimate use - DPDPA 2023 course lesson banner
Advertisement

What you will learn about consent or legitimate use

  • Name the two grounds
  • Choose the right ground for a purpose
  • Avoid stretching the legitimate uses

Section 4 (consent or legitimate use)

A person may process personal data only for a lawful purpose, and only (a) with the consent of the Data Principal, or (b) for certain legitimate uses. There is no general legitimate-interest ground as in GDPR.

Choosing your ground: click each

Select a numbered box to read more.

1Startpurpose2Is it alisted use?3If yes4If no5Record it
Tap or click a step to see exactly what to do.
Advertisement

Ground by example (consent or legitimate use)

ActivityGround
NewsletterConsent
Delivering an order the customer placedVoluntary provision (legitimate use)
Payroll for employeesEmployment (legitimate use)
Tax recordsLegal obligation
Targeted adsConsent
Selling a customer listConsent, specific to that sale

Worked example

A cafe asks for a phone number to send an order-ready SMS. That is a voluntary provision for a stated purpose. Using the same number for ads needs fresh consent.

Activity (5 minutes) (consent or legitimate use)

For five purposes in your business, write the ground you rely on.

Key takeaway: The ground belongs to the purpose, not to the data. A new purpose needs a new ground.

Check your understanding of consent or legitimate use

Q1. How many grounds does Section 4 allow?

Q2. Is there a general legitimate interest ground?

Q3. Ads based on a delivery phone number need:

← Module 4 homeWhat valid consent looks like →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for consent or legitimate use: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.