Process personal data only with valid consent or a legitimate use, after notice
Under India DPDP Act, Sections 4 to 7
Source-linked
Open official source
What does it require?
Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act. A notice must describe the data, purpose, and how to exercise rights and complain.
Practical action
Inventory training and inference data sources and document the consent or legitimate use for each.
Who does it apply to?
All Data Fiduciaries.
- Sectors
- Cross-sector / all sectors
Evidence examples
- Consent records and notices (record)
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Annex A controls on data for AI systems | Original editorial mapping. | medium |
Similar obligations in other instruments
- Identify consent or an applicable PDPA exception before using personal data in AI — PDPC AI advisory guidelines, Singapore
- Collect and use personal information only with consent and for the stated purpose — Nepal Privacy Act 2075, Nepal
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.