What Is Data Processing?
LawThe Act defines processing broadly — essentially any operation performed on personal data, whether automated or not: collection, recording, organisation, storage, use, adaptation, retrieval, disclosure, or erasure. This matters because it means the Act's obligations don't just apply to "using" data in some narrow sense — simply storing personal data you collected is itself processing, and it needs its own lawful basis just as much as actively using that data would.
The Purpose of Processing
LawEvery lawful processing activity has to be tied to a specific, stated purpose — this is the practical expression of the purpose-limitation principle introduced in Chapter 01. You can't collect data broadly and decide what to do with it later; the purpose needs to be identified at or before collection, communicated through the notice (Section 5), and the processing has to actually stay within it.
Two Lawful Grounds
LawSection 4 sets out that personal data may only be processed for a lawful purpose, on one of two grounds: consent, given in accordance with Section 6 (covered fully in Chapter 04), or one of the certain legitimate uses listed in Section 7. There's no third, open-ended category — if a processing activity doesn't fit either ground, it isn't lawful under DPDP, however useful or well-intentioned it might be.
Certain Legitimate Uses
LawSection 7 sets out a specific, closed list rather than GDPR's broader "legitimate interest" balancing test. It includes scenarios such as: a Data Principal voluntarily providing their data for a specified purpose (and not indicating they don't consent to its use); processing by the State for permits, licences, benefits, or services; compliance with a judgment, order, or law; responding to a medical emergency or a threat to life or health; and certain employment-related purposes, such as safeguarding an employer against loss or liability, or providing services or benefits to an employee. This list is illustrative rather than exhaustive here — check the Act's actual text for the complete list before relying on any specific clause for a real compliance decision.
An employer processing attendance-system data to run payroll is very plausibly relying on the employment-related legitimate use in Section 7, not on employee consent — which is helpful, since consent from an employee to their own employer is often questioned as not being genuinely "free" given the power imbalance involved.
Collection, Use, and Storage
PracticeThese are the earliest stages of the lifecycle introduced in Chapter 02. Collection should gather only what the stated purpose requires (data minimisation); use should stay within that purpose; storage should apply security safeguards proportionate to what's held (Chapter 09) and shouldn't outlast the retention schedule you've set (Chapter 08).
Sharing and Disclosure
LawSharing data with a third party — a vendor, a partner, an affiliate — is itself a processing activity requiring its own lawful ground. If the original consent or legitimate use didn't cover sharing with that specific third party for that purpose, sharing it anyway isn't covered by the original basis; it needs its own. This is the same point Chapter 04 makes about third-party consent, applied at the processing-lawfulness level rather than the consent-mechanics level.
Third-Party Processing
Where a third party is processing data on your behalf under contract, they're acting as a Data Processor rather than an independent Data Fiduciary — Chapter 12 covers the due-diligence and contractual side of that relationship in depth.
The Processing Lifecycle
PracticePutting the stages in sequence: a lawful basis is established → notice is given (if relying on consent) → data is collected → used within the stated purpose → stored with proportionate safeguards → shared only where that sharing was itself covered by the lawful basis → retained only as long as necessary → erased or anonymised once the purpose is served. Section 8's general obligations — accuracy, security, breach notification, erasure — apply across this whole sequence, regardless of which of the two lawful grounds the processing relies on.