Section 4: Grounds for processing personal data

Key takeaways

Who should read this

In plain language

Section 4 is the hinge of the Act's obligations. It says you may process personal data only in accordance with the Act and only for a lawful purpose, defined as any purpose not expressly forbidden by law.

It then narrows the lawful bases to two: either the Data Principal has given consent under Section 6, or the processing falls within one of the certain legitimate uses listed in Section 7. Unlike some regimes, there is no open-ended "legitimate interests" test, the legitimate uses are a fixed list.

In practice this means, for every processing activity, you should be able to name the ground: consent, or a specific legitimate use. If you cannot, you should not be processing.

The text of the law

Wording reproduced or summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.

What this means for you

• For each processing purpose, record whether you rely on consent or a specific legitimate use.
• Do not assume a GDPR-style "legitimate interests" balancing test, it does not exist here.
• If consent is your ground, you must also serve a Section 5 notice.
• Retire any processing you cannot tie to a lawful ground.