Glossary
What is purpose limitation under DPDP?
Purpose limitation means using personal data only for the purpose you stated. The DPDP Act builds it in through several sections rather than a single definition.
Definition
Purpose limitation is not a defined term in the DPDP Act, 2023, but the idea runs through it: personal data is processed for a lawful purpose (s.4), consent is limited to the data necessary for the specified purpose (s.6), and data is erased once the purpose is no longer served (s.8(7)). Rule 3 requires the notice to itemise the personal data and the specified purposes.
What it means
Use personal data only for the purpose you stated and the Data Principal consented to, or that a legitimate use allows. A new purpose needs its own ground: consent given against a notice for it, or a legitimate use that fits.
When the purpose is no longer served, erase the data unless a law requires you to keep it (s.8(7)). See duties of a Data Fiduciary.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.4 | Process only for a lawful purpose, with consent or for a legitimate use |
| s.5, Rule 3 | The notice itemises the personal data and the specified purposes |
| s.6 | Consent is limited to the data necessary for the specified purpose |
| s.7(a) | Voluntarily provided data, for a specified purpose |
| s.8(7) | Erase when the purpose is no longer served |
| Rule 8 | When a purpose is deemed no longer served, for Third Schedule classes |
Common misconceptions
- “The Act defines purpose limitation.” It does not use a single definition; the duty comes from s.4, s.5, s.6 and s.8(7).
- “One broad purpose covers everything.” Consent must be specific, and Rule 3 asks for an itemised description of purposes.
- “Keep data in case it is useful later.” s.8(7) requires erasure once the purpose is no longer served, unless a law requires retention.
Related terms
Free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6).
NoticeThe information that comes with every request for consent (s.5, Rule 3).
RetentionHow long personal data is kept before erasure (s.8(7), Rule 8).
Legitimate usesThe listed grounds for processing without consent (s.7).
In TruePrivacy
Consent management records consent per person and per purpose, with an event log for each. Retention rules then act on data when its keep-for period ends, optionally with approval.
Is purpose limitation in the DPDP Act?
Not as a defined term. The duty comes from s.4 (lawful purpose), s.6 (consent limited to the specified purpose) and s.8(7) (erasure when the purpose is no longer served).
Can I use data collected for one purpose for another?
Only with a ground for the new purpose: consent given against a notice for it, or a legitimate use under s.7. Check edge cases with counsel.
How do I show purpose limitation in practice?
Keep an itemised list of purposes in your notice (Rule 3), a consent record per purpose, and retention rules tied to each purpose.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin