Every data protection law on earth answers one question before all others: when is it lawful to process someone's personal data at all? Europe's answer runs six lanes wide — consent, contract, legal obligation, vital interests, public tasks, and the flexible catch-all called legitimate interests that carries most of the commercial internet. India looked at that six-lane highway and built two lanes: consent, or a closed list of legitimate uses. Nothing in between. That choice is the single most consequential design decision in the entire statute.

Arc 2 opens here — the Act, section by section — and it begins at the foundation stone. What "lawful purpose" actually means, and why its modesty surprises people: the law doesn't police ambition; it polices authorisation. The two doors every processing activity must pass through. The absences that define the architecture: no contract basis, no legitimate-interest balancing test — and the fair account of why India refused the ground the rest of the world relies on, choosing a closed list Parliament controls over an open standard companies interpret and regulators chase.

Then the consequences. Why consent becomes the workhorse, and consent engineering the load-bearing wall of Indian data operations. Why the product manager's instinct — "we need it to run the feature" — maps to nothing automatic here, and where the gap between "we need it" and "we have a basis for it" will surprise compliance programmes. The four-column basis-mapping exercise that converts Section 4 into a working document, and why the rows ending in shrugs are violations-in-waiting. Plus the honest note on interpretation: how the Board's early orders will calibrate the system, and the compliance-safe posture until they do.

DPDP Daily takes India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 out of the statute book and into real life — for compliance officers, lawyers, founders, small business owners and citizens. One practical episode every day, no jargon.

I'm Harmeet Singh Kapoor, author of the DPDP Act Compliance Handbook: From Law to Ground Reality.

Keywords: Section 4 DPDP, lawful basis, consent, legitimate uses, legitimate interest India, GDPR comparison, lawful purpose, DPDP Act section by section, data processing grounds, DPDP compliance.

Connect with me:
💼 LinkedIn: https://www.linkedin.com/in/hskapoor/
📄 Facebook: https://www.facebook.com/satarkintelligence
▶️ YouTube: https://www.youtube.com/@DPDPdaily
🎙️ Apple Podcasts: https://podcasts.apple.com/us/podcast/dpdp-daily/id6793257111
𝕏 X: https://x.com/TheOtherKapoor

One practical DPDP insight every morning on LinkedIn, Facebook and X — and the DPDP Act Compliance Handbook: From Law to Ground Reality coming soon.

This episode is educational commentary, not legal advice. The DPDP framework is in phased implementation and positions described may evolve through notifications, Board publications and judicial interpretation. For decisions affecting your organisation or your rights, consult a qualified professional with your specific facts.