Concept
The specified purpose is the exact reason for processing that a Data Fiduciary states in its notice. Consent and data collected are limited to it.
"specified purpose" means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder.
Purpose is the anchor of the whole consent model. Data can be processed only for the purpose named in the notice, and only the data that purpose needs.
Once the specified purpose is fulfilled or abandoned, the basis for keeping the data falls away, which is why retention is tied back to it under Section 8.
If the specified purpose is 'delivering your order', the fiduciary cannot quietly reuse the same data for advertising without a fresh basis.
Who sets the specified purpose?
The Data Fiduciary, by stating it in the notice given to the Data Principal before consent.
Can data be used beyond the specified purpose?
Not on the same consent. A new purpose needs a fresh notice and consent, or another lawful basis.