Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsConcept
The specified purpose is the exact reason for processing that a Data Fiduciary states in its notice. Consent and data collected are limited to it.
TL;DR
The specified purpose (Section 2(za)) is the exact reason for processing that a Data Fiduciary states in its notice, and both the consent and the data collected are limited to it. Once the purpose is fulfilled or abandoned, the basis for keeping the data falls away.
"specified purpose" means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder.
Purpose is the anchor of the whole consent model. Data can be processed only for the purpose named in the notice, and only the data that purpose needs.
Once the specified purpose is fulfilled or abandoned, the basis for keeping the data falls away, which is why retention is tied back to it under Section 8.
If the specified purpose is 'delivering your order', the fiduciary cannot quietly reuse the same data for advertising without a fresh basis.
Who sets the specified purpose?
The Data Fiduciary, by stating it in the notice given to the Data Principal before consent.
Can data be used beyond the specified purpose?
Not on the same consent. A new purpose needs a fresh notice and consent, or another lawful basis.
Consultant-led and partner-backed.