Sections 4-7 of DPDP Act 2023 establish the foundational lawful processing framework. Section 4 Grounds for Processing Personal Data: a person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose - (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses (Section 7). Section 5 Notice: every request made to a Data Principal for consent shall be accompanied or preceded by a notice given by the Data Fiduciary to the Data Principal informing her - (i) the personal data and the purpose for which the same is proposed to be processed; (ii) the manner in which she may exercise her rights under Section 11 (Right to Information) + Section 13 (Right to Grievance Redressal) + and may make a complaint to the Board (DPBI); (iii) the manner in which the Data Principal may make a complaint to the Board. Section 5(2) Multi-Language Notice: information given in the notice shall be available in English or any language specified in the Eighth Schedule of the Constitution (22 languages including Hindi + Tamil + Bengali + Telugu + Marathi + Gujarati + Kannada + Malayalam + Punjabi + Odia + Assamese + Urdu + Sanskrit + Sindhi + Konkani + Manipuri + Nepali + Kashmiri + Maithili + Santali + Dogri + Bodo). Section 6 Consent: must be free + specific + informed + unconditional + unambiguous with clear affirmative action + signify agreement to the processing for specified purpose + limited to such personal data as is necessary for such specified purpose. Section 6(4) Withdrawal of Consent: shall be as easy as giving consent + on withdrawal of consent the Data Fiduciary shall cease processing within a reasonable time + shall cause its Data Processors to cease processing the personal data of Data Principal. Section 6(5) Itemised Notice: itemising of personal data items and purposes. Section 6(7) Consent Manager: every Consent Manager shall be registered with the Data Protection Board of India + acts as a single point of contact to enable a Data Principal to give consent + manage consent + review consent + withdraw consent - this links DPDP to RBI Account Aggregator (NBFC-AA licensees register as Consent Managers under DPDP). Section 7 Certain Legitimate Uses (Lawful Without Consent): Personal data may be processed for the specified purpose for which the Data Principal has voluntarily provided her personal data + government processing for subsidy/benefit/service/licence/permit (with safeguards) + judicial functions + medical emergency + employment-related purpose + necessary to respond to medical emergency + necessary for safety of public during a disaster + breakdown of public order. Coordinates with RBI Account Aggregator Framework (DPDP Sec 6(7) Consent Manager links AA NBFC-AA licensees registered as DPDP CMs) + GDPR Art 13-14 + UK GDPR + Singapore PDPA + India Stack DPI + Aadhaar Act consent + 22 official languages + Constitution 8th Schedule. DPDP Sec 4-7 Notice + Consent + Lawful Processing applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.