Lawful Basis for Processing Personal Data

The Two Pillars of Lawful Processing

The DPDP Act establishes a positive obligation regime. This means data processing is prohibited by default, unless the Data Fiduciary can affirmatively justify it based on a specific legal ground.

Section 4 of the Act provides two, and only two, legal grounds for processing personal data for a "lawful purpose":

1. Consent: The Data Principal has given their explicit permission.
2. Certain Legitimate Uses: The processing is justified by a specific, enumerated reason in the Act that does not require consent.

A "lawful purpose" is simply any purpose not expressly forbidden by law. The real challenge lies in correctly identifying and applying the appropriate legal ground.

To begin, let's turn to a detailed legal interpretation of Section 4 of the DPDP Act. This resource will serve as our primary guide for this part of the lesson.

As you've just read, every single data processing activity must be mapped to either consent or a legitimate use. There is no middle ground or third option. Let's now dissect each of these pillars in detail.

Pillar 1: Consent – The Gold Standard

Consent is the primary legal basis for processing personal data under the DPDP Act. It embodies the principle of individual autonomy, giving the Data Principal direct control over their data.

However, "consent" under the DPDP Act is not a simple checkbox. The Act sets a very high bar for what constitutes valid consent. To understand the practical meaning of this, let's watch a brief segment that frames consent as a fundamental right, analogous to rights over physical property.

The Anatomy of Valid Consent (Section 6)

The analogy in the video highlights the spirit of the law. Section 6 of the Act provides the letter, defining the six mandatory attributes of valid consent. It must be:

1. Free
2. Specific
3. Informed
4. Unconditional
5. Unambiguous
6. Withdrawable

To dive deep into these requirements, we will use another excellent resource that interprets Section 6 in great detail. Given your preference for rigorous analysis, this text will provide the necessary depth.

Let’s reinforce these crucial points from the reading with a summary:

• Free: Consent cannot be coerced. A service cannot be denied if a user refuses consent for data processing that is not necessary for that service (e.g., a flashlight app demanding access to your contacts). This directly targets the "take-it-or-leave-it" approach common in many apps.
• Specific: Consent must be for a clearly stated purpose. If you collect an email for order updates, you cannot use it for marketing without obtaining fresh, specific consent for that new purpose.
• Informed: The user must be provided with a clear notice (under Section 5) before consent is given.
• Unambiguous: Consent requires a "clear affirmative action," like the user actively ticking a box. This outlaws pre-checked boxes and "by using this site, you agree..." banners.
• Withdrawable: The process to withdraw consent must be as easy as the process to give it. This is the "easy in, easy out" principle.

Given your interest in comparative law, you will find the comparison table between DPDPA and GDPR in the resource LINK (section 12) particularly insightful. Note that in some areas, such as the explicit prohibition of bundling and stricter rules for children's data, the DPDP Act's consent requirements are even more stringent than GDPR's.

Pillar 2: 'Legitimate Uses' – The Exceptions to Consent

The DPDP Act recognizes that requiring consent in every situation is impractical and can sometimes conflict with public interest or other legal obligations. Therefore, it provides a second legal ground: "certain legitimate uses".

It is crucial to understand that, unlike GDPR's flexible "legitimate interests" clause, the DPDP Act provides a closed and exhaustive list of situations where data can be processed without consent. A Data Fiduciary cannot invent its own legitimate use; it must fit squarely into one of the categories defined in Section 7 of the Act.

Let's watch a segment from the Khaitan & Co webinar that explains this second bucket of lawful processing.

The key categories of "Legitimate Uses" most relevant to corporate and AI contexts include:

• Voluntary Provision: When a Data Principal voluntarily provides their data for a specific purpose and has not indicated they do not consent (e.g., giving a phone number to a pharmacist to receive an invoice).
• State Functions: For the performance of any function under law by the State, such as providing benefits or issuing licenses.
• Legal Compliance: To comply with any Indian law or court order.
• Employment: For purposes related to employment, including recruitment and safeguarding the employer from loss or liability.
• Public Safety & Emergencies: In response to medical emergencies, disasters, or to maintain public order.

The resource LINK (dpdpa.com on Sec 4) provides an excellent table and case studies under the "Ground 2: Legitimate Uses" heading. For instance, a fintech lending app processing KYC data to comply with anti-money laundering laws would rely on "Legitimate Use" (legal compliance), not consent. However, to use that same customer's data to market an unrelated insurance product, it would absolutely need to obtain specific, valid consent.

Conclusion

Today, we have analyzed the two exclusive legal grounds for processing personal data under the DPDP Act: high-standard consent and a narrow list of legitimate uses. Understanding this binary framework is the first and most critical step in ensuring any AI system is compliant with Indian law.

Key Takeaways:

• A Two-Pillar System: All personal data processing in India must be justified by either the Data Principal's valid consent or by fitting into a specific, enumerated 'Legitimate Use'.
• Consent is a High Bar: Valid consent must be Free, Specific, Informed, Unambiguous, Unconditional, and Withdrawable (FISU-UW). Practices like pre-checked boxes, bundled consent for unrelated purposes, and "consent-or-no-service" models are now largely unlawful.
• Legitimate Uses are a Closed List: This is not a flexible balancing test like GDPR's "legitimate interests." A Data Fiduciary must map their processing activity to a specific category in Section 7 of the Act to proceed without consent.
• The Burden of Proof: The Data Fiduciary is always responsible for demonstrating the legal basis for its data processing activities.

Preview of the Next Lesson:

Now that we have mastered the foundational principles, rights, obligations, and legal grounds for processing, we are ready to apply this knowledge to the entire AI lifecycle. In our next lesson, we will apply the DPDP Act's requirements to AI data collection, training, and deployment scenarios. We will move from legal theory to practical application, analyzing how to lawfully gather training data, justify the processing during model development, and manage the legal basis for an AI system that makes real-world decisions about individuals.