Section 6 · Section 8(7)
Purpose limitation for DPDP compliance
Under DPDP, the purpose comes first: it shapes the notice, limits the consent and sets when data must go. TruePrivacy keeps purposes in one place.
Sample workspace
Consent by purpose DP-••2259
- Loan applicationGiven
- Credit bureau checkGiven
- Partner offersRejected
- Specified purposes.6(1)
Event log
- Consent requested for three purposes
- Two purposes given
- Partner offers rejected
Short answer
The DPDP Act allows processing only for a lawful purpose, with consent or for a legitimate use (s.4). Consent is limited to the personal data necessary for the specified purpose (s.6(1)), the notice itemises each purpose (Rule 3), and data is erased once the purpose is no longer served (s.8(7)). TruePrivacy records consent per person and purpose, and runs retention rules per processing activity.
What purpose controls do
Purpose runs through the whole Act: the notice states it, consent is limited to it, and erasure follows when it ends. Keeping one list of purposes lets each of those duties refer to the same thing.
Define each purpose in consent management; consent is recorded per person and purpose.
The website tracker scan categorises trackers so they can become consent purposes.
Records of processing list your processing activities, synced from discovery.
Set retention rules per processing activity.
Discovery shows which systems and fields hold personal data, so you can check what each purpose uses.
How to keep processing to its purpose
- 01Name each purpose
Write each purpose so a person can tell what they are agreeing to, and itemise the goods, services or uses the processing enables (Rule 3).
- 02Choose the ground
For each purpose, decide whether you rely on consent (s.6) or a legitimate use (s.7). Read legitimate uses before relying on one.
- 03Itemise in the notice
List the personal data and each purpose in the notice (Rule 3), and record consent per purpose.
- 04Set an end
Decide when each purpose is no longer served and set a retention rule for it.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Process only for a lawful purpose, with consent or a legitimate use | s.4 | Purposes in consent management; processing activities in your records |
| Consent limited to the data necessary for the specified purpose | s.6(1) | Consent recorded per person and per purpose |
| Itemised purposes in the notice | s.5, Rule 3 | One list of purposes to write the notice from |
| Stop processing after consent is withdrawn | s.6(6) | Withdrawal recorded per purpose, for your systems and processors to act on |
| Erase when the purpose is no longer served | s.8(7), Rule 8 | Retention rules per processing activity, data category or connected system |
Purpose decisions are legal decisions
TruePrivacy records the purposes you define and the rules you set. Whether a new use fits an existing purpose, and when a purpose is no longer served, are judgements for your team and counsel. Outside consent, s.7 lists the legitimate uses you can rely on.
For e-commerce, social media and online gaming platforms in the Third Schedule, Rule 8 sets when a purpose is deemed no longer served. Read consent under section 6 for how purpose and consent fit together.
Works with
Consent per person and purpose, with an event log and receipts.
NoticesItemise each purpose in the notice that comes with a consent request.
Retention and erasureRetention rules that end processing when the purpose ends.
AI governanceCheck that AI models using personal data stay within your purposes.
What is purpose limitation under DPDP?
The DPDP Act ties processing to a lawful purpose (s.4), limits consent to the data necessary for a specified purpose (s.6(1)) and requires erasure once the purpose is no longer served (s.8(7)).
Can I use data collected for one purpose for another?
Consent covers the specified purpose. A new purpose needs its own ground under s.4: consent with a notice, or a legitimate use under s.7. Check with counsel.
When is a purpose no longer served?
Rule 8 sets the period for the classes in the Third Schedule. For other processing, decide the period with counsel and record it as a retention rule.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin