# Process personal data only with valid consent or a legitimate use, after notice

- **Record type**: Obligation
- **Instrument**: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
- **Jurisdiction**: India
- **Category**: privacy_data_protection
- **Binding**: Yes
- **Provision**: Sections 4 to 7

## In brief

Process personal data only with valid consent or a legitimate use, after notice is a legal requirement under the India DPDP Act in India (Sections 4 to 7). Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act.

## What the duty requires

Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act. A notice must describe the data, purpose, and how to exercise rights and complain.

## What an organisation does about it

Inventory training and inference data sources and document the consent or legitimate use for each.

## Controls that meet this duty

- Privacy and data-protection controls for AI (satisfies): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai
- Data governance and dataset documentation (supports): https://aipolicytracker.org/controls/data-governance-and-dataset-documentation

## Parent instrument

- Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
  - Record: https://aipolicytracker.org/policies/india-dpdp-act
  - Context file: https://aipolicytracker.org/policies/india-dpdp-act.md

## Provenance

- **Permanent id**: AIPT-OBL-0049 (https://aipolicytracker.org/id/AIPT-OBL-0049; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice
- **Official source**: https://www.meity.gov.in/data-protection-framework
- **Provision**: Sections 4 to 7
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Process personal data only with valid consent or a legitimate use, after notice (India DPDP Act)" [AIPT-OBL-0049, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0049 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.