Grounds for processing personal data
Process personal data only for a lawful purpose, and only either with the Data Principal's consent or for a certain legitimate use. Every processing activity must be traceable to one of those two grounds.
Section 4DPDP Act, 2023Data Fiduciary
What this requires
Process personal data only for a lawful purpose, and only either with the Data Principal's consent or for a certain legitimate use. Every processing activity must be traceable to one of those two grounds.
Evidence a regulator would accept
- Processing Register
- Legal basis assessment
- Purpose registry
How this product discharges it
assessment (primary)consentdiscovery
Our position
Changing this recalculates the readiness score immediately.
- Current
- Partially compliant
- Residual risk
- Medium
- Owner
- Meera Iyer
- Last reviewed
- 18 Jul 2026
- Next review due
- 06 Sept 2026
Open gaps (4)
Gaps raised against this obligation. Closing one moves this clause forward.
- CriticalAI assistant processes personal data with no recorded legal basisGAP-2026-0210 · Priya Nair · open
- HighLegacy pension tape archive never scannedGAP-2026-0219 · Dr. Kavya Menon · in remediation
- MediumSkill development portal connector failing for 11 daysGAP-2026-0221 · Arjun Malhotra · verified
- HighPurpose deviation on 22 elements in the analytics lakeGAP-2026-0225 · Rohit Verma · verified
Evidence (0)
Documents indexed against this obligation in the evidence vault.
No evidence attached yet. Open the evidence vault.
History
- Clause status updated following remediationyesterday06 Aug 2026, 00:30Deepika Joshi
- Clause status updated following remediation4 days ago03 Aug 2026, 17:30Rohit Verma
- Clause status updated following remediation6 days ago01 Aug 2026, 10:30Naveen Kulkarni
- Clause status updated following remediation8 days ago30 Jul 2026, 06:30Vikram Saxena
- Clause status updated following remediation10 days ago28 Jul 2026, 00:30Imran Sethi
- Clause status updated following remediation13 days ago25 Jul 2026, 16:30System
- Position reviewed and recorded20 days ago18 Jul 2026, 11:55Meera Iyer
Related obligations
- S.7Certain legitimate usesCompliant
- S.8(4)Reasonable security safeguardsPartially compliant
- S.17ExemptionsNot applicable
- R.5Processing for State subsidy, benefit, service, certificate, licence or permitCompliant
- R.6Reasonable security safeguardsPartially compliant
- R.15Research, archiving and statistical purposesNot applicable