Section 4: Grounds for Processing Personal Data
Chapter: Obligations of Data Fiduciary
Maximum Penalty: Up to ₹250 Crore
Overview
Establishes two legal grounds: consent and legitimate uses. This section falls under the "Obligations of Data Fiduciary" chapter of the Digital Personal Data Protection Act 2023, which was enacted to establish a comprehensive framework for data protection in India.
Key Points of Section 4
- Personal data can only be processed for lawful purposes with the Data Principal's consent or for certain legitimate uses
- Consent must be free, specific, informed, unconditional, and unambiguous
- Data Fiduciary must provide notice before or at the time of requesting consent
Who This Applies To
Every Data Fiduciary collecting personal data from individuals
Compliance Action Steps
- Review all consent collection mechanisms for compliance
- Implement clear consent notices in plain language
- Ensure consent is granular and not bundled with service terms
- Build systems to record and manage consent lifecycle
How Complynz Helps
Complynz automates compliance with Section 4 through AI-powered assessments, policy templates, and continuous monitoring. Our platform maps each DPDP provision to actionable controls so your team can achieve and maintain compliance efficiently.
Take Free DPDP Assessment | DPDP Compliance Checklist | View Pricing