Process personal data only with valid consent or a legitimate use, after notice

Practical action

Inventory training and inference data sources and document the consent or legitimate use for each.

Who does it apply to?

All Data Fiduciaries.

Actors

Provider / developerDeployer / user organisation

Sectors

Cross-sector / all sectors

Use cases

AI in finance, credit and insuranceGenerative AI and foundation models

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessData protection officer · once per ai system
  Privacy and data-protection controls for AI

  Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use

  Legal basis and notice recorded for each training and inference data source.

• supportsProcessData governance lead · once per ai system
  Data governance and dataset documentation

  Serves 8 recorded duties · evidence: Dataset documentation sheet, Data quality and bias check report, Dataset approval for use

  Dataset documentation records consent status per source.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

• AI Data Governance Register

  Register · XLSX and DOCX · v3

• AI Audit Evidence Tracker

  Register · XLSX · v1

All 5 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every India duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Process personal data only with valid consent or a legitimate use, after notice (India DPDP Act)” [AIPT-OBL-0049, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0049 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0049: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Data Protection Framework — Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, Government of India, https://www.meity.gov.in/data-protection-framework.

@misc{aipolicytracker2026_processpersonaldataonlyw,
  author       = {{AIPolicyTracker}},
  title        = {{Process personal data only with valid consent or a legitimate use, after notice (India DPDP Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice}},
  url          = {https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Deployers must use the provider's transparency information in their data protection impact assessment — EU AI Act, European Union
• Collect and use personal information only with consent and for the stated purpose — Nepal Privacy Act 2075, Nepal
• Identify consent or an applicable PDPA exception before using personal data in AI — PDPC AI advisory guidelines, Singapore
• Employers and employment agencies must disclose the data collected and their retention policy for the tool — NYC Local Law 144 (automated employment decision tools), New York (United States)